#ifndef _NTDLL_H
#define _NTDLL_H

#pragma once

#ifdef __cplusplus
extern "C" {
#endif

#ifndef WIN32_NO_STATUS
#define WIN32_NO_STATUS
#endif
#include <Windows.h>
#undef WIN32_NO_STATUS
#include <intrin.h>
#include <ntstatus.h>

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define NT_ERROR(Status) ((((ULONG)(Status)) >> 30) == 3)

#define FASTCALL __fastcall

#ifndef _Reserved_
#define _Reserved_
#endif

#define ALIGN_DOWN(length, type) ((ULONG)(length) & ~(sizeof(type) - 1))

#define ALIGN_UP(length, type) \
  (ALIGN_DOWN(((ULONG)(length) + sizeof(type) - 1), type))

#define MIN(a, b) (((a) < (b)) ? (a) : (b))
#define MAX(a, b) (((a) > (b)) ? (a) : (b))

typedef LONG NTSTATUS, *PNTSTATUS;
typedef LONG KPRIORITY, *PKPRIORITY;
typedef ULONG LOGICAL, *PLOGICAL;

typedef struct _CLIENT_ID {
  HANDLE UniqueProcess;
  HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

enum KPROCESSOR_MODE { KernelMode, UserMode };

typedef enum _KTHREAD_STATE {
  Initialized,
  Ready,
  Running,
  Standby,
  Terminated,
  Waiting,
  Transition,
  DeferredReady,
  GateWaitObsolete,
  WaitingForProcessInSwap,
  MaximumThreadState
} KTHREAD_STATE,
    *PKTHREAD_STATE;

typedef enum _KWAIT_REASON {
  Executive,
  FreePage,
  PageIn,
  PoolAllocation,
  DelayExecution,
  Suspended,
  UserRequest,
  WrExecutive,
  WrFreePage,
  WrPageIn,
  WrPoolAllocation,
  WrDelayExecution,
  WrSuspended,
  WrUserRequest,
  WrEventPair,
  WrQueue,
  WrLpcReceive,
  WrLpcReply,
  WrVirtualMemory,
  WrPageOut,
  WrRendezvous,
  WrKeyedEvent,
  WrTerminated,
  WrProcessInSwap,
  WrCpuRateControl,
  WrCalloutStack,
  WrKernel,
  WrResource,
  WrPushLock,
  WrMutex,
  WrQuantumEnd,
  WrDispatchInt,
  WrPreempted,
  WrYieldExecution,
  WrFastMutex,
  WrGuardedMutex,
  WrRundown,
  WrAlertByThreadId,
  WrDeferredPreempt,
  MaximumWaitReason
} KWAIT_REASON;

typedef enum _EVENT_TYPE { NotificationEvent, SynchronizationEvent } EVENT_TYPE;

typedef enum _TIMER_TYPE { NotificationTimer, SynchronizationTimer } TIMER_TYPE;

typedef enum _WAIT_TYPE {
  WaitAll,
  WaitAny,
  WaitNotification,
  WaitDequeue
} WAIT_TYPE;

typedef enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 } SECTION_INHERIT;

#define HARDERROR_OVERRIDE_ERRORMODE 0x10000000

typedef enum _HARDERROR_RESPONSE_OPTION {
  OptionAbortRetryIgnore,
  OptionOk,
  OptionOkCancel,
  OptionRetryCancel,
  OptionYesNo,
  OptionYesNoCancel,
  OptionShutdownSystem,
  OptionOkNoWait,
  OptionCancelTryContinue
} HARDERROR_RESPONSE_OPTION,
    *PHARDERROR_RESPONSE_OPTION;

typedef enum _HARDERROR_RESPONSE {
  ResponseReturnToCaller,
  ResponseNotHandled,
  ResponseAbort,
  ResponseCancel,
  ResponseIgnore,
  ResponseNo,
  ResponseOk,
  ResponseRetry,
  ResponseYes,
  ResponseTryAgain,
  ResponseContinue
} HARDERROR_RESPONSE,
    *PHARDERROR_RESPONSE;

typedef struct _UNICODE_STRING {
  USHORT Length;
  USHORT MaximumLength;
  PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef const UNICODE_STRING* PCUNICODE_STRING;

#define DECLARE_UNICODE_STRING_SIZE(_var, _size)                \
  WCHAR _var##_buffer[_size];                                   \
  __pragma(warning(push)) __pragma(warning(disable : 4221))     \
      __pragma(warning(disable : 4204)) UNICODE_STRING _var = { \
          0, (_size) * sizeof(WCHAR), _var##_buffer} __pragma(warning(pop))

#define DECLARE_STATIC_UNICODE_STRING_SIZE(_var, _size)                \
  WCHAR _var##_buffer[_size];                                          \
  __pragma(warning(push)) __pragma(warning(disable : 4221))            \
      __pragma(warning(disable : 4204)) static UNICODE_STRING _var = { \
          0, (_size) * sizeof(WCHAR), _var##_buffer} __pragma(warning(pop))

#if defined(__clang__)
#define RTL_CONSTANT_STRING(s)                                      \
  __pragma(clang diagnostic push) __pragma(clang diagnostic ignored \
                                           "-Wwritable-strings"){   \
      sizeof(s) - sizeof((s)[0]), sizeof(s), s} __pragma(clang diagnostic pop)
#else
#define RTL_CONSTANT_STRING(s) \
  { sizeof(s) - sizeof((s)[0]), sizeof(s), (PWSTR)s }
#define RTL_CONSTANT_ANSI_STRING(s) \
  { sizeof(s) - sizeof((s)[0]), sizeof(s), (PSTR)s }
#endif

FORCEINLINE
VOID RtlInitEmptyUnicodeString(_Out_ PUNICODE_STRING UnicodeString,
                               _In_ PWCHAR Buffer, _In_ USHORT BufferSize) {
  UnicodeString->Length = 0;
  UnicodeString->MaximumLength = BufferSize;
  UnicodeString->Buffer = Buffer;
}

typedef struct _STRING {
  USHORT Length;
  USHORT MaximumLength;
  PCHAR Buffer;
} ANSI_STRING, *PANSI_STRING;

typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION {
  ULONG SessionId;
  ULONG SizeOfBuf;
  PVOID Buffer;
} SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;

typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION {
  BOOLEAN KernelDebuggerEnabled;
  BOOLEAN KernelDebuggerNotPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;

typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX {
  BOOLEAN DebuggerAllowed;
  BOOLEAN DebuggerEnabled;
  BOOLEAN DebuggerPresent;
} SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX,
    *PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX;

typedef struct _LDT_INFORMATION {
  ULONG Start;
  ULONG Length;
  LDT_ENTRY LdtEntries[1];
} PROCESS_LDT_INFORMATION, *PPROCESS_LDT_INFORMATION;

typedef struct _KERNEL_USER_TIMES {
  LARGE_INTEGER CreateTime;
  LARGE_INTEGER ExitTime;
  LARGE_INTEGER KernelTime;
  LARGE_INTEGER UserTime;
} KERNEL_USER_TIMES, *PKERNEL_USER_TIMES;

typedef struct _SYSTEM_THREAD_INFORMATION {
  LARGE_INTEGER KernelTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER CreateTime;
  ULONG WaitTime;
  PVOID StartAddress;
  CLIENT_ID ClientId;
  KPRIORITY Priority;
  LONG BasePriority;
  ULONG ContextSwitches;
  ULONG ThreadState;
  KWAIT_REASON WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION {
  ULONG NextEntryOffset;
  ULONG NumberOfThreads;
  LARGE_INTEGER WorkingSetPrivateSize;  // Since Vista
  ULONG HardFaultCount;                 // Since Windows 7
  ULONG NumberOfThreadsHighWatermark;   // Since Windows 7
  ULONGLONG CycleTime;                  // Since Windows 7
  LARGE_INTEGER CreateTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER KernelTime;
  UNICODE_STRING ImageName;
  KPRIORITY BasePriority;
  HANDLE UniqueProcessId;
  HANDLE InheritedFromUniqueProcessId;
  ULONG HandleCount;
  ULONG SessionId;
  ULONG_PTR UniqueProcessKey;  // Since Vista (requires
                               // SystemExtendedProcessInformation)
  SIZE_T PeakVirtualSize;
  SIZE_T VirtualSize;
  ULONG PageFaultCount;
  SIZE_T PeakWorkingSetSize;
  SIZE_T WorkingSetSize;
  SIZE_T QuotaPeakPagedPoolUsage;
  SIZE_T QuotaPagedPoolUsage;
  SIZE_T QuotaPeakNonPagedPoolUsage;
  SIZE_T QuotaNonPagedPoolUsage;
  SIZE_T PagefileUsage;
  SIZE_T PeakPagefileUsage;
  SIZE_T PrivatePageCount;
  LARGE_INTEGER ReadOperationCount;
  LARGE_INTEGER WriteOperationCount;
  LARGE_INTEGER OtherOperationCount;
  LARGE_INTEGER ReadTransferCount;
  LARGE_INTEGER WriteTransferCount;
  LARGE_INTEGER OtherTransferCount;
  SYSTEM_THREAD_INFORMATION Threads[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef struct _PROCESS_SESSION_INFORMATION {
  ULONG SessionId;
} PROCESS_SESSION_INFORMATION, *PPROCESS_SESSION_INFORMATION;

// File attribute values
#define FILE_ATTRIBUTE_READONLY 0x00000001
#define FILE_ATTRIBUTE_HIDDEN 0x00000002
#define FILE_ATTRIBUTE_SYSTEM 0x00000004

#define FILE_ATTRIBUTE_DIRECTORY 0x00000010
#define FILE_ATTRIBUTE_ARCHIVE 0x00000020
#define FILE_ATTRIBUTE_DEVICE 0x00000040
#define FILE_ATTRIBUTE_NORMAL 0x00000080

#define FILE_ATTRIBUTE_TEMPORARY 0x00000100
#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
#define FILE_ATTRIBUTE_COMPRESSED 0x00000800

#define FILE_ATTRIBUTE_OFFLINE 0x00001000
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000

#define FILE_ATTRIBUTE_INTEGRITY_STREAM 0x00008000
#define FILE_ATTRIBUTE_VIRTUAL 0x00010000
#define FILE_ATTRIBUTE_NO_SCRUB_DATA 0x00020000

#define FILE_ATTRIBUTE_EA 0x00040000
#define FILE_ATTRIBUTE_PINNED 0x00080000
#define FILE_ATTRIBUTE_UNPINNED 0x00100000
#define FILE_ATTRIBUTE_RECALL_ON_OPEN 0x00040000
#define FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS 0x00400000

#if NTDDI_VERSION < NTDDI_WIN8
#define FILE_ATTRIBUTE_VALID_FLAGS 0x00007fb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000031a7
#elif NTDDI_VERSION < NTDDI_WIN10_RS2
#define FILE_ATTRIBUTE_VALID_FLAGS 0x0002ffb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x000231a7
#else
#define FILE_ATTRIBUTE_VALID_FLAGS 0x005affb7
#define FILE_ATTRIBUTE_VALID_SET_FLAGS 0x001a31a7
#endif

// File create disposition values
#define FILE_SUPERSEDE 0x00000000
#define FILE_OPEN 0x00000001
#define FILE_CREATE 0x00000002
#define FILE_OPEN_IF 0x00000003
#define FILE_OVERWRITE 0x00000004
#define FILE_OVERWRITE_IF 0x00000005
#define FILE_MAXIMUM_DISPOSITION 0x00000005

// File create/open option flags
#define FILE_DIRECTORY_FILE 0x00000001
#define FILE_WRITE_THROUGH 0x00000002
#define FILE_SEQUENTIAL_ONLY 0x00000004
#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008

#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
#define FILE_NON_DIRECTORY_FILE 0x00000040
#define FILE_CREATE_TREE_CONNECTION 0x00000080

#define FILE_COMPLETE_IF_OPLOCKED 0x00000100
#define FILE_NO_EA_KNOWLEDGE 0x00000200
#define FILE_OPEN_FOR_RECOVERY 0x00000400
#define FILE_RANDOM_ACCESS 0x00000800

#define FILE_DELETE_ON_CLOSE 0x00001000
#define FILE_OPEN_BY_FILE_ID 0x00002000
#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000
#define FILE_NO_COMPRESSION 0x00008000

#if NTDDI_VERSION >= NTDDI_WIN7
#define FILE_OPEN_REQUIRING_OPLOCK 0x00010000
#define FILE_DISALLOW_EXCLUSIVE 0x00020000
#endif
#if NTDDI_VERSION >= NTDDI_WIN8
#define FILE_SESSION_AWARE 0x00040000
#endif

#define FILE_RESERVE_OPFILTER 0x00100000
#define FILE_OPEN_REPARSE_POINT 0x00200000
#define FILE_OPEN_NO_RECALL 0x00400000
#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000

#define FILE_VALID_OPTION_FLAGS 0x00ffffff
#define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032
#define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032
#define FILE_VALID_SET_FLAGS 0x00000036

// Named pipe type flags
#define FILE_PIPE_BYTE_STREAM_TYPE 0x00000000
#define FILE_PIPE_MESSAGE_TYPE 0x00000001
#define FILE_PIPE_ACCEPT_REMOTE_CLIENTS 0x00000000
#define FILE_PIPE_REJECT_REMOTE_CLIENTS 0x00000002
#define FILE_PIPE_TYPE_VALID_MASK 0x00000003

// Named pipe completion mode flags
#define FILE_PIPE_QUEUE_OPERATION 0x00000000
#define FILE_PIPE_COMPLETE_OPERATION 0x00000001

// Named pipe read mode flags
#define FILE_PIPE_BYTE_STREAM_MODE 0x00000000
#define FILE_PIPE_MESSAGE_MODE 0x00000001

// NamedPipeConfiguration flags
#define FILE_PIPE_INBOUND 0x00000000
#define FILE_PIPE_OUTBOUND 0x00000001
#define FILE_PIPE_FULL_DUPLEX 0x00000002

// NamedPipeState flags
#define FILE_PIPE_DISCONNECTED_STATE 0x00000001
#define FILE_PIPE_LISTENING_STATE 0x00000002
#define FILE_PIPE_CONNECTED_STATE 0x00000003
#define FILE_PIPE_CLOSING_STATE 0x00000004

// NamedPipeEnd flags
#define FILE_PIPE_CLIENT_END 0x00000000
#define FILE_PIPE_SERVER_END 0x00000001

typedef struct _FILE_BASIC_INFORMATION {
  LARGE_INTEGER CreationTime;
  LARGE_INTEGER LastAccessTime;
  LARGE_INTEGER LastWriteTime;
  LARGE_INTEGER ChangeTime;
  ULONG FileAttributes;
} FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION;

typedef struct _FILE_STANDARD_INFORMATION {
  LARGE_INTEGER AllocationSize;
  LARGE_INTEGER EndOfFile;
  ULONG NumberOfLinks;
  BOOLEAN DeletePending;
  BOOLEAN Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;

typedef struct _FILE_POSITION_INFORMATION {
  LARGE_INTEGER CurrentByteOffset;
} FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION;

typedef struct _THREAD_BASIC_INFORMATION {
  NTSTATUS ExitStatus;
  PVOID TebBaseAddress;
  CLIENT_ID ClientId;
  ULONG_PTR AffinityMask;
  KPRIORITY Priority;
  LONG BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef struct _MEMORY_REGION_INFORMATION {
  PVOID AllocationBase;
  ULONG AllocationProtect;
  union {
    ULONG RegionType;
    struct {
      ULONG Private : 1;
      ULONG MappedDataFile : 1;
      ULONG MappedImage : 1;
      ULONG MappedPageFile : 1;
      ULONG MappedPhysical : 1;
      ULONG DirectMapped : 1;
      ULONG Reserved : 26;
    } s;
  } u;
  SIZE_T RegionSize;
  SIZE_T CommitSize;
} MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION;

typedef struct _SECTION_BASIC_INFORMATION {
  PVOID BaseAddress;
  ULONG AllocationAttributes;
  LARGE_INTEGER MaximumSize;
} SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

typedef struct _SECTION_IMAGE_INFORMATION {
  PVOID TransferAddress;  // Entry point
  ULONG ZeroBits;
  SIZE_T MaximumStackSize;
  SIZE_T CommittedStackSize;
  ULONG SubSystemType;
  union {
    struct {
      USHORT SubSystemMinorVersion;
      USHORT SubSystemMajorVersion;
    } s1;
    ULONG SubSystemVersion;
  } u1;
  union {
    struct {
      USHORT MajorOperatingSystemVersion;
      USHORT MinorOperatingSystemVersion;
    } s2;
    ULONG OperatingSystemVersion;
  } u2;
  USHORT ImageCharacteristics;
  USHORT DllCharacteristics;
  USHORT Machine;
  BOOLEAN ImageContainsCode;
  union {
    UCHAR ImageFlags;
    struct {
      UCHAR ComPlusNativeReady : 1;
      UCHAR ComPlusILOnly : 1;
      UCHAR ImageDynamicallyRelocated : 1;
      UCHAR ImageMappedFlat : 1;
      UCHAR BaseBelow4gb : 1;
      UCHAR ComPlusPrefer32bit : 1;
      UCHAR Reserved : 2;
    } s3;
  } u3;
  ULONG LoaderFlags;
  ULONG ImageFileSize;
  ULONG CheckSum;
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

typedef struct _SECTION_INTERNAL_IMAGE_INFORMATION {
  SECTION_IMAGE_INFORMATION SectionInformation;
  union {
    ULONG ExtendedFlags;
    struct {
      ULONG ImageReturnFlowGuardEnabled : 1;
      ULONG ImageReturnFlowGuardStrict : 1;
      ULONG ImageExportSuppressionEnabled : 1;
      ULONG Reserved : 29;
    } s;
  } u;
} SECTION_INTERNAL_IMAGE_INFORMATION, *PSECTION_INTERNAL_IMAGE_INFORMATION;

typedef struct _OBJECT_ATTRIBUTES {
  ULONG Length;
  HANDLE RootDirectory;
  PUNICODE_STRING ObjectName;
  ULONG Attributes;
  PVOID SecurityDescriptor;
  PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

// https://stackoverflow.com/questions/36961152/detect-windows-kit-8-0-and-windows-kit-8-1-sdks
#if defined(WINAPI_PARTITION_APP)
#if defined(WINAPI_FAMILY_SYSTEM)
#define USING_WINDOWS_10_SDK
#elif (WINAPI_PARTITION_APP == 0x00000002) || (WINAPI_PARTITION_APP == 1)
#define USING_WINDOWS_8_x_SDK
#endif
#endif

// This struct was included in winnt.h starting in the Windows 8.0 SDK
#if !(defined(USING_WINDOWS_8_x_SDK) || defined(USING_WINDOWS_10_SDK))
typedef struct _EXCEPTION_REGISTRATION_RECORD {
  _EXCEPTION_REGISTRATION_RECORD* Next;
  _EXCEPTION_DISPOSITION Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;
#endif

#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001
#define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002

#define LDR_GET_PROCEDURE_ADDRESS_EX_DONT_RECORD_FORWARDER 0x00000001

#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002

#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2

#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001

typedef struct _LDR_RESOURCE_INFO {
  ULONG_PTR Type;
  ULONG_PTR Name;
  ULONG_PTR Language;
} LDR_RESOURCE_INFO, *PLDR_RESOURCE_INFO;

typedef struct _LDR_ENUM_RESOURCE_INFO {
  ULONG_PTR Type;
  ULONG_PTR Name;
  ULONG_PTR Language;
  PVOID Data;
  SIZE_T Size;
  ULONG_PTR Reserved;
} LDR_ENUM_RESOURCE_INFO, *PLDR_ENUM_RESOURCE_INFO;

#define LDR_FIND_RESOURCE_LANGUAGE_CAN_FALLBACK 0x00000000
#define LDR_FIND_RESOURCE_LANGUAGE_EXACT 0x00000004
#define LDR_FIND_RESOURCE_LANGUAGE_REDIRECT_VERSION 0x00000008

typedef struct _RTL_PROCESS_MODULE_INFORMATION {
  HANDLE Section;
  PVOID MappedBase;
  PVOID ImageBase;
  ULONG ImageSize;
  ULONG Flags;
  USHORT LoadOrderIndex;
  USHORT InitOrderIndex;
  USHORT LoadCount;
  USHORT OffsetToFileName;
  UCHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES {
  ULONG NumberOfModules;
  RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX {
  USHORT NextOffset;
  RTL_PROCESS_MODULE_INFORMATION BaseInfo;
  ULONG ImageChecksum;
  ULONG TimeDateStamp;
  PVOID DefaultBase;
} RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX;

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
  USHORT UniqueProcessId;
  USHORT CreatorBackTraceIndex;
  UCHAR ObjectTypeIndex;
  UCHAR HandleAttributes;
  USHORT HandleValue;
  PVOID Object;
  ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

typedef struct _SYSTEM_HANDLE_INFORMATION {
  ULONG NumberOfHandles;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
  PVOID Object;
  ULONG_PTR UniqueProcessId;
  ULONG_PTR HandleValue;
  ULONG GrantedAccess;
  USHORT CreatorBackTraceIndex;
  USHORT ObjectTypeIndex;
  ULONG HandleAttributes;
  ULONG Reserved;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;

typedef struct _SYSTEM_HANDLE_INFORMATION_EX {
  ULONG_PTR NumberOfHandles;
  ULONG_PTR Reserved;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;

typedef struct _OBJECT_BASIC_INFORMATION {
  ULONG Attributes;
  ACCESS_MASK GrantedAccess;
  ULONG HandleCount;
  ULONG PointerCount;
  ULONG PagedPoolCharge;
  ULONG NonPagedPoolCharge;
  ULONG Reserved[3];
  ULONG NameInfoSize;
  ULONG TypeInfoSize;
  ULONG SecurityDescriptorSize;
  LARGE_INTEGER CreationTime;
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_NAME_INFORMATION {
  UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION {
  UNICODE_STRING TypeName;
  ULONG TotalNumberOfObjects;
  ULONG TotalNumberOfHandles;
  ULONG TotalPagedPoolUsage;
  ULONG TotalNonPagedPoolUsage;
  ULONG TotalNamePoolUsage;
  ULONG TotalHandleTableUsage;
  ULONG HighWaterNumberOfObjects;
  ULONG HighWaterNumberOfHandles;
  ULONG HighWaterPagedPoolUsage;
  ULONG HighWaterNonPagedPoolUsage;
  ULONG HighWaterNamePoolUsage;
  ULONG HighWaterHandleTableUsage;
  ULONG InvalidAttributes;
  GENERIC_MAPPING GenericMapping;
  ULONG ValidAccessMask;
  BOOLEAN SecurityRequired;
  BOOLEAN MaintainHandleCount;
  UCHAR TypeIndex;  // Since Windows 8.1
  CHAR ReservedByte;
  ULONG PoolType;
  ULONG DefaultPagedPoolCharge;
  ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_TYPES_INFORMATION {
  ULONG NumberOfTypes;
  OBJECT_TYPE_INFORMATION TypeInformation[1];
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;

typedef struct _OBJECT_HANDLE_FLAG_INFORMATION {
  BOOLEAN Inherit;
  BOOLEAN ProtectFromClose;
} OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;

typedef struct _DBGKM_EXCEPTION {
  EXCEPTION_RECORD ExceptionRecord;
  ULONG FirstChance;
} DBGKM_EXCEPTION, *PDBGKM_EXCEPTION;

typedef struct _DBGKM_CREATE_THREAD {
  ULONG SubSystemKey;
  PVOID StartAddress;
} DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD;

typedef struct _DBGKM_CREATE_PROCESS {
  ULONG SubSystemKey;
  HANDLE FileHandle;
  PVOID BaseOfImage;
  ULONG DebugInfoFileOffset;
  ULONG DebugInfoSize;
  DBGKM_CREATE_THREAD InitialThread;
} DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS;

typedef struct _DBGKM_EXIT_THREAD {
  NTSTATUS ExitStatus;
} DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD;

typedef struct _DBGKM_EXIT_PROCESS {
  NTSTATUS ExitStatus;
} DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS;

typedef struct _DBGKM_LOAD_DLL {
  HANDLE FileHandle;
  PVOID BaseOfDll;
  ULONG DebugInfoFileOffset;
  ULONG DebugInfoSize;
  PVOID NamePointer;
} DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL;

typedef struct _DBGKM_UNLOAD_DLL {
  PVOID BaseAddress;
} DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL;

typedef enum _DBG_STATE {
  DbgIdle,
  DbgReplyPending,
  DbgCreateThreadStateChange,
  DbgCreateProcessStateChange,
  DbgExitThreadStateChange,
  DbgExitProcessStateChange,
  DbgExceptionStateChange,
  DbgBreakpointStateChange,
  DbgSingleStepStateChange,
  DbgLoadDllStateChange,
  DbgUnloadDllStateChange
} DBG_STATE,
    *PDBG_STATE;

typedef struct _DBGUI_CREATE_THREAD {
  HANDLE HandleToThread;
  DBGKM_CREATE_THREAD NewThread;
} DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD;

typedef struct _DBGUI_CREATE_PROCESS {
  HANDLE HandleToProcess;
  HANDLE HandleToThread;
  DBGKM_CREATE_PROCESS NewProcess;
} DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS;

typedef struct _DBGUI_WAIT_STATE_CHANGE {
  DBG_STATE NewState;
  CLIENT_ID AppClientId;
  union {
    DBGKM_EXCEPTION Exception;
    DBGUI_CREATE_THREAD CreateThread;
    DBGUI_CREATE_PROCESS CreateProcessInfo;
    DBGKM_EXIT_THREAD ExitThread;
    DBGKM_EXIT_PROCESS ExitProcess;
    DBGKM_LOAD_DLL LoadDll;
    DBGKM_UNLOAD_DLL UnloadDll;
  } StateInfo;
} DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE;

typedef struct _DBGSS_THREAD_DATA {
  struct _DBGSS_THREAD_DATA* Next;
  HANDLE ThreadHandle;
  HANDLE ProcessHandle;
  ULONG ProcessId;
  ULONG ThreadId;
  BOOLEAN HandleMarked;
} DBGSS_THREAD_DATA, *PDBGSS_THREAD_DATA;

#define DbgSsSetThreadData(d) NtCurrentTeb()->DbgSsReserved[0] = d

#define DbgSsGetThreadData() \
  ((PDBGSS_THREAD_DATA)NtCurrentTeb()->DbgSsReserved[0])

typedef USHORT RTL_ATOM, *PRTL_ATOM;
typedef long SECURITY_STATUS;

typedef struct _RTL_SPLAY_LINKS {
  struct _RTL_SPLAY_LINKS* Parent;
  struct _RTL_SPLAY_LINKS* LeftChild;
  struct _RTL_SPLAY_LINKS* RightChild;
} RTL_SPLAY_LINKS, *PRTL_SPLAY_LINKS;

#define RtlInitializeSplayLinks(Links)       \
  {                                          \
    PRTL_SPLAY_LINKS _SplayLinks;            \
    _SplayLinks = (PRTL_SPLAY_LINKS)(Links); \
    _SplayLinks->Parent = _SplayLinks;       \
    _SplayLinks->LeftChild = NULL;           \
    _SplayLinks->RightChild = NULL;          \
  }

typedef struct _PREFIX_TABLE_ENTRY {
  SHORT NodeTypeCode;
  SHORT NameLength;
  struct _PREFIX_TABLE_ENTRY* NextPrefixTree;
  RTL_SPLAY_LINKS Links;
  PANSI_STRING Prefix;
} PREFIX_TABLE_ENTRY, *PPREFIX_TABLE_ENTRY;

typedef struct _PREFIX_TABLE {
  SHORT NodeTypeCode;
  SHORT NameLength;
  PPREFIX_TABLE_ENTRY NextPrefixTree;
} PREFIX_TABLE, *PPREFIX_TABLE;

typedef struct _RTL_BITMAP {
  ULONG SizeOfBitMap;
  PULONG Buffer;
} RTL_BITMAP, *PRTL_BITMAP;

typedef struct _RTL_BITMAP_RUN {
  ULONG StartingIndex;
  ULONG NumberOfBits;
} RTL_BITMAP_RUN, *PRTL_BITMAP_RUN;

typedef enum {
  RtlBsdItemVersionNumber = 0x00,
  RtlBsdItemProductType,
  RtlBsdItemAabEnabled,
  RtlBsdItemAabTimeout,
  RtlBsdItemBootGood,
  RtlBsdItemBootShutdown,
  RtlBsdItemMax
} RTL_BSD_ITEM_TYPE,
    *PRTL_BSD_ITEM_TYPE;

#define DUPLICATE_CLOSE_SOURCE 0x00000001
#define DUPLICATE_SAME_ACCESS 0x00000002
#define DUPLICATE_SAME_ATTRIBUTES 0x00000004

#define RTL_WALK_MAX_STACK_DEPTH 128

// These cannot be ORed together
#define RTL_WALK_KERNEL_MODE_STACK 0x00000000  // Kernel mode callers only
#define RTL_WALK_USER_MODE_STACK 0x00000001
#define RTL_WALK_TRACE_HANDLES 0x00000300

typedef struct _RTL_PROCESS_VERIFIER_OPTIONS {
  ULONG SizeStruct;
  ULONG Option;
  UCHAR OptionData[1];
} RTL_PROCESS_VERIFIER_OPTIONS, *PRTL_PROCESS_VERIFIER_OPTIONS;

typedef struct _RTL_DEBUG_INFORMATION {
  HANDLE SectionHandleClient;
  PVOID ViewBaseClient;
  PVOID ViewBaseTarget;
  ULONG_PTR ViewBaseDelta;
  HANDLE EventPairClient;
  HANDLE EventPairTarget;
  HANDLE TargetProcessId;
  HANDLE TargetThreadHandle;
  ULONG Flags;
  SIZE_T OffsetFree;
  SIZE_T CommitSize;
  SIZE_T ViewSize;
  union {
    PRTL_PROCESS_MODULES Modules;
    PRTL_PROCESS_MODULE_INFORMATION_EX ModulesEx;
  };
  struct _RTL_PROCESS_BACKTRACES* BackTraces;
  struct _RTL_PROCESS_HEAPS* Heaps;
  struct _RTL_PROCESS_LOCKS* Locks;
  PVOID SpecificHeap;
  HANDLE TargetProcessHandle;
  PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions;
  PVOID ProcessHeap;
  HANDLE CriticalSectionHandle;
  HANDLE CriticalSectionOwnerThread;
  PVOID Reserved[4];
} RTL_DEBUG_INFORMATION, *PRTL_DEBUG_INFORMATION;

typedef VOID (*PPS_APC_ROUTINE)(_In_opt_ PVOID ApcArgument1,
                                _In_opt_ PVOID ApcArgument2,
                                _In_opt_ PVOID ApcArgument3);

typedef struct _RTLP_CURDIR_REF* PRTLP_CURDIR_REF;

typedef struct _RTL_RELATIVE_NAME_U {
  UNICODE_STRING RelativeName;
  HANDLE ContainingDirectory;
  PRTLP_CURDIR_REF CurDirRef;
} RTL_RELATIVE_NAME_U, *PRTL_RELATIVE_NAME_U;

typedef enum _RTL_PATH_TYPE {
  RtlPathTypeUnknown,
  RtlPathTypeUncAbsolute,
  RtlPathTypeDriveAbsolute,
  RtlPathTypeDriveRelative,
  RtlPathTypeRooted,
  RtlPathTypeRelative,
  RtlPathTypeLocalDevice,
  RtlPathTypeRootLocalDevice,
} RTL_PATH_TYPE;

#define DOS_MAX_COMPONENT_LENGTH 255
#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5)

typedef struct _CURDIR {
  UNICODE_STRING DosPath;
  HANDLE Handle;
} CURDIR, *PCURDIR;

#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002
#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003

typedef struct _RTL_DRIVE_LETTER_CURDIR {
  USHORT Flags;
  USHORT Length;
  ULONG TimeStamp;
  UNICODE_STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

#define RTL_MAX_DRIVE_LETTERS 32
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001

typedef struct _LDR_SERVICE_TAG_RECORD {
  struct _LDR_SERVICE_TAG_RECORD* Next;
  ULONG ServiceTag;
} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;

typedef struct _LDRP_CSLIST {
  PSINGLE_LIST_ENTRY Tail;
} LDRP_CSLIST, *PLDRP_CSLIST;

typedef enum _LDR_DDAG_STATE {
  LdrModulesMerged = -5,
  LdrModulesInitError = -4,
  LdrModulesSnapError = -3,
  LdrModulesUnloaded = -2,
  LdrModulesUnloading = -1,
  LdrModulesPlaceHolder = 0,
  LdrModulesMapping = 1,
  LdrModulesMapped = 2,
  LdrModulesWaitingForDependencies = 3,
  LdrModulesSnapping = 4,
  LdrModulesSnapped = 5,
  LdrModulesCondensed = 6,
  LdrModulesReadyToInit = 7,
  LdrModulesInitializing = 8,
  LdrModulesReadyToRun = 9
} LDR_DDAG_STATE;

typedef struct _LDR_DDAG_NODE {
  LIST_ENTRY Modules;
  PLDR_SERVICE_TAG_RECORD ServiceTagList;
  ULONG LoadCount;
  ULONG LoadWhileUnloadingCount;
  ULONG LowestLink;
  union {
    LDRP_CSLIST Dependencies;
    SINGLE_LIST_ENTRY RemovalLink;
  };
  LDRP_CSLIST IncomingDependencies;
  LDR_DDAG_STATE State;
  SINGLE_LIST_ENTRY CondenseLink;
  ULONG PreorderNumber;
} LDR_DDAG_NODE, *PLDR_DDAG_NODE;

typedef struct _LDR_DEPENDENCY_RECORD {
  SINGLE_LIST_ENTRY DependencyLink;
  PLDR_DDAG_NODE DependencyNode;
  SINGLE_LIST_ENTRY IncomingDependencyLink;
  PLDR_DDAG_NODE IncomingDependencyNode;
} LDR_DEPENDENCY_RECORD, *PLDR_DEPENDENCY_RECORD;

typedef enum _LDR_DLL_LOAD_REASON {
  LoadReasonStaticDependency,
  LoadReasonStaticForwarderDependency,
  LoadReasonDynamicForwarderDependency,
  LoadReasonDelayloadDependency,
  LoadReasonDynamicLoad,
  LoadReasonAsImageLoad,
  LoadReasonAsDataLoad,
  LoadReasonUnknown = -1
} LDR_DLL_LOAD_REASON,
    *PLDR_DLL_LOAD_REASON;

#define LDRP_PACKAGED_BINARY 0x00000001
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_LOAD_IN_PROGRESS 0x00001000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
#define LDRP_PROCESS_ATTACH_FAILED 0x00100000
#define LDRP_IMAGE_NOT_AT_BASE 0x00200000  // Vista and below
#define LDRP_COR_IMAGE 0x00400000
#define LDRP_DONT_RELOCATE 0x00800000
#define LDRP_REDIRECTED 0x10000000
#define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000

#define LDR_DATA_TABLE_ENTRY_SIZE_WINXP \
  FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, DdagNode)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN7 \
  FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, BaseNameHashValue)
#define LDR_DATA_TABLE_ENTRY_SIZE_WIN8 \
  FIELD_OFFSET(LDR_DATA_TABLE_ENTRY, ImplicitPathOptions)

#define RTL_BALANCED_NODE_RESERVED_PARENT_MASK 3

typedef struct _RTL_BALANCED_NODE {
  union {
    struct _RTL_BALANCED_NODE* Children[2];
    struct {
      struct _RTL_BALANCED_NODE* Left;
      struct _RTL_BALANCED_NODE* Right;
    } s;
  };
  union {
    UCHAR Red : 1;
    UCHAR Balance : 2;
    ULONG_PTR ParentValue;
  } u;
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;

typedef struct _LDR_DATA_TABLE_ENTRY {
  LIST_ENTRY InLoadOrderLinks;
  LIST_ENTRY InMemoryOrderLinks;
  union {
    LIST_ENTRY InInitializationOrderLinks;
    LIST_ENTRY InProgressLinks;
  };
  PVOID DllBase;
  PVOID EntryPoint;
  ULONG SizeOfImage;
  UNICODE_STRING FullDllName;
  UNICODE_STRING BaseDllName;
  union {
    UCHAR FlagGroup[4];
    ULONG Flags;
    struct {
      ULONG PackagedBinary : 1;
      ULONG MarkedForRemoval : 1;
      ULONG ImageDll : 1;
      ULONG LoadNotificationsSent : 1;
      ULONG TelemetryEntryProcessed : 1;
      ULONG ProcessStaticImport : 1;
      ULONG InLegacyLists : 1;
      ULONG InIndexes : 1;
      ULONG ShimDll : 1;
      ULONG InExceptionTable : 1;
      ULONG ReservedFlags1 : 2;
      ULONG LoadInProgress : 1;
      ULONG LoadConfigProcessed : 1;
      ULONG EntryProcessed : 1;
      ULONG ProtectDelayLoad : 1;
      ULONG ReservedFlags3 : 2;
      ULONG DontCallForThreads : 1;
      ULONG ProcessAttachCalled : 1;
      ULONG ProcessAttachFailed : 1;
      ULONG CorDeferredValidate : 1;
      ULONG CorImage : 1;
      ULONG DontRelocate : 1;
      ULONG CorILOnly : 1;
      ULONG ReservedFlags5 : 3;
      ULONG Redirected : 1;
      ULONG ReservedFlags6 : 2;
      ULONG CompatDatabaseProcessed : 1;
    } s;
  } u;
  USHORT ObsoleteLoadCount;
  USHORT TlsIndex;
  LIST_ENTRY HashLinks;
  ULONG TimeDateStamp;
  struct _ACTIVATION_CONTEXT* EntryPointActivationContext;
  PVOID Lock;
  PLDR_DDAG_NODE DdagNode;
  LIST_ENTRY NodeModuleLink;
  struct _LDRP_LOAD_CONTEXT* LoadContext;
  PVOID ParentDllBase;
  PVOID SwitchBackContext;
  RTL_BALANCED_NODE BaseAddressIndexNode;
  RTL_BALANCED_NODE MappingInfoIndexNode;
  ULONG_PTR OriginalBase;
  LARGE_INTEGER LoadTime;
  ULONG BaseNameHashValue;
  LDR_DLL_LOAD_REASON LoadReason;
  ULONG ImplicitPathOptions;
  ULONG ReferenceCount;
  ULONG DependentLoadFlags;
  UCHAR SigningLevel;  // Since Windows 10 RS2
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _INITIAL_TEB {
  struct {
    PVOID OldStackBase;
    PVOID OldStackLimit;
  } OldInitialTeb;
  PVOID StackBase;
  PVOID StackLimit;
  PVOID StackAllocationBase;
} INITIAL_TEB, *PINITIAL_TEB;

typedef struct _IO_STATUS_BLOCK {
  union {
    NTSTATUS Status;
    PVOID Pointer;
  };
  ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef VOID(NTAPI* PIO_APC_ROUTINE)(_In_ PVOID ApcContext,
                                     _In_ PIO_STATUS_BLOCK IoStatusBlock,
                                     _In_ ULONG Reserved);

typedef struct _FILE_IO_COMPLETION_INFORMATION {
  PVOID KeyContext;
  PVOID ApcContext;
  IO_STATUS_BLOCK IoStatusBlock;
} FILE_IO_COMPLETION_INFORMATION, *PFILE_IO_COMPLETION_INFORMATION;

typedef struct _FILE_COMPLETION_INFORMATION {
  HANDLE Port;
  PVOID Key;
} FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION;

#ifdef __cplusplus
typedef enum _PRIORITY_CLASS : UCHAR {
  Undefined,
  Idle,
  Normal,
  High,
  Realtime,
  BelowNormal,
  AboveNormal
} PRIORITY_CLASS;
#else
typedef UCHAR PRIORITY_CLASS;
#endif

typedef struct _PROCESS_PRIORITY_CLASS {
  BOOLEAN Foreground;
  PRIORITY_CLASS PriorityClass;
} PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS;

typedef struct _PS_ATTRIBUTE {
  ULONG_PTR Attribute;  // PROC_THREAD_ATTRIBUTE_XXX | PROC_THREAD_ATTRIBUTE_XXX
                        // modifiers, see ProcThreadAttributeValue macro and
                        // Windows Internals 6 (372)
  SIZE_T Size;          // Size of Value or *ValuePtr
  union {
    ULONG_PTR
        Value;  // Reserve 8 bytes for data (such as a Handle or a data pointer)
    PVOID ValuePtr;  // data pointer
  };
  PSIZE_T ReturnLength;  // Either 0 or specifies size of data returned to
                         // caller via "ValuePtr"
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;

typedef struct _PS_ATTRIBUTE_LIST {
  SIZE_T TotalLength;          // sizeof(PS_ATTRIBUTE_LIST)
  PS_ATTRIBUTE Attributes[2];  // Depends on how many attribute entries should
                               // be supplied to NtCreateUserProcess
} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;

typedef struct _PS_MEMORY_RESERVE {
  PVOID ReserveAddress;
  SIZE_T ReserveSize;
} PS_MEMORY_RESERVE, *PPS_MEMORY_RESERVE;

#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff
#define PS_ATTRIBUTE_THREAD \
  0x00010000  // Attribute may be used with thread creation
#define PS_ATTRIBUTE_INPUT 0x00020000  // Attribute is input only
#define PS_ATTRIBUTE_ADDITIVE \
  0x00040000  // Attribute may be "accumulated", e.g. bitmasks, counters, etc.

typedef enum _PS_ATTRIBUTE_NUM {
  PsAttributeParentProcess,   // in HANDLE
  PsAttributeDebugPort,       // in HANDLE
  PsAttributeToken,           // in HANDLE
  PsAttributeClientId,        // out PCLIENT_ID
  PsAttributeTebAddress,      // out PTEB
  PsAttributeImageName,       // in PWSTR
  PsAttributeImageInfo,       // out PSECTION_IMAGE_INFORMATION
  PsAttributeMemoryReserve,   // in PPS_MEMORY_RESERVE
  PsAttributePriorityClass,   // in UCHAR
  PsAttributeErrorMode,       // in ULONG
  PsAttributeStdHandleInfo,   // in PPS_STD_HANDLE_INFO
  PsAttributeHandleList,      // in PHANDLE
  PsAttributeGroupAffinity,   // in PGROUP_AFFINITY
  PsAttributePreferredNode,   // in PUSHORT
  PsAttributeIdealProcessor,  // in PPROCESSOR_NUMBER
  PsAttributeUmsThread,       // see MSDN UpdateProceThreadAttributeList
                         // (CreateProcessW) - in PUMS_CREATE_THREAD_ATTRIBUTES
  PsAttributeMitigationOptions,  // in UCHAR
  PsAttributeProtectionLevel,    // in ULONG
  PsAttributeSecureProcess,      // since THRESHOLD (Virtual Secure Mode, Device
                                 // Guard)
  PsAttributeJobList,
  PsAttributeChildProcessPolicy,            // since THRESHOLD2
  PsAttributeAllApplicationPackagesPolicy,  // since REDSTONE
  PsAttributeWin32kFilter,
  PsAttributeSafeOpenPromptOriginClaim,
  PsAttributeBnoIsolation,
  PsAttributeDesktopAppPolicy,
  PsAttributeMax
} PS_ATTRIBUTE_NUM;

#define PsAttributeValue(Number, Thread, Input, Additive)                      \
  (((Number)&PS_ATTRIBUTE_NUMBER_MASK) |                                       \
   ((Thread) ? PS_ATTRIBUTE_THREAD : 0) | ((Input) ? PS_ATTRIBUTE_INPUT : 0) | \
   ((Additive) ? PS_ATTRIBUTE_ADDITIVE : 0))

#define PS_ATTRIBUTE_PARENT_PROCESS \
  PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE)  // 0x60000
#define PS_ATTRIBUTE_DEBUG_PORT \
  PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE)  // 0x60001
#define PS_ATTRIBUTE_TOKEN \
  PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE)  // 0x60002
#define PS_ATTRIBUTE_CLIENT_ID \
  PsAttributeValue(PsAttributeClientId, TRUE, FALSE, FALSE)  // 0x10003
#define PS_ATTRIBUTE_TEB_ADDRESS \
  PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE)  // 0x10004
#define PS_ATTRIBUTE_IMAGE_NAME \
  PsAttributeValue(PsAttributeImageName, FALSE, TRUE, FALSE)  // 0x20005
#define PS_ATTRIBUTE_IMAGE_INFO \
  PsAttributeValue(PsAttributeImageInfo, FALSE, FALSE, FALSE)  // 0x6
#define PS_ATTRIBUTE_MEMORY_RESERVE \
  PsAttributeValue(PsAttributeMemoryReserve, FALSE, TRUE, FALSE)  // 0x20007
#define PS_ATTRIBUTE_PRIORITY_CLASS \
  PsAttributeValue(PsAttributePriorityClass, FALSE, TRUE, FALSE)  // 0x20008
#define PS_ATTRIBUTE_ERROR_MODE \
  PsAttributeValue(PsAttributeErrorMode, FALSE, TRUE, FALSE)  // 0x20009
#define PS_ATTRIBUTE_STD_HANDLE_INFO \
  PsAttributeValue(PsAttributeStdHandleInfo, FALSE, TRUE, FALSE)  // 0x2000A
#define PS_ATTRIBUTE_HANDLE_LIST \
  PsAttributeValue(PsAttributeHandleList, FALSE, TRUE, FALSE)  // 0x2000B
#define PS_ATTRIBUTE_GROUP_AFFINITY \
  PsAttributeValue(PsAttributeGroupAffinity, TRUE, TRUE, FALSE)  // 0x2000C
#define PS_ATTRIBUTE_PREFERRED_NODE \
  PsAttributeValue(PsAttributePreferredNode, FALSE, TRUE, FALSE)  // 0x2000D
#define PS_ATTRIBUTE_IDEAL_PROCESSOR \
  PsAttributeValue(PsAttributeIdealProcessor, TRUE, TRUE, FALSE)  // 0x2000E
#define PS_ATTRIBUTE_MITIGATION_OPTIONS \
  PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE)  // 0x60010
#define PS_ATTRIBUTE_PROTECTION_LEVEL \
  PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, FALSE)  // 0x20011

typedef enum _PS_STD_HANDLE_STATE {
  PsNeverDuplicate,
  PsRequestDuplicate,  // Duplicate standard handles specified by
                       // PseudoHandleMask, and only if StdHandleSubsystemType
                       // matches the image subsystem
  PsAlwaysDuplicate,   // Always duplicate standard handles
  PsMaxStdHandleStates
} PS_STD_HANDLE_STATE;

#define HANDLE_DETACHED_PROCESS ((HANDLE)-1)
#define HANDLE_CREATE_NEW_CONSOLE ((HANDLE)-2)
#define HANDLE_CREATE_NO_WINDOW ((HANDLE)-3)

#define PS_STD_INPUT_HANDLE 0x1
#define PS_STD_OUTPUT_HANDLE 0x2
#define PS_STD_ERROR_HANDLE 0x4

typedef struct _PS_STD_HANDLE_INFO {
  union {
    ULONG Flags;
    struct {
      ULONG StdHandleState : 2;    // PS_STD_HANDLE_STATE
      ULONG PseudoHandleMask : 3;  // PS_STD_*
    } s;
  };
  ULONG StdHandleSubsystemType;
} PS_STD_HANDLE_INFO, *PPS_STD_HANDLE_INFO;

typedef struct _PS_BNO_ISOLATION_PARAMETERS {
  UNICODE_STRING IsolationPrefix;
  ULONG HandleCount;
  PVOID* Handles;
  BOOLEAN IsolationEnabled;
} PS_BNO_ISOLATION_PARAMETERS, *PPS_BNO_ISOLATION_PARAMETERS;

typedef enum _PS_MITIGATION_OPTION {
  PS_MITIGATION_OPTION_NX,
  PS_MITIGATION_OPTION_SEHOP,
  PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES,
  PS_MITIGATION_OPTION_HEAP_TERMINATE,
  PS_MITIGATION_OPTION_BOTTOM_UP_ASLR,
  PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR,
  PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS,
  PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE,
  PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE,
  PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE,
  PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD,
  PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES,
  PS_MITIGATION_OPTION_FONT_DISABLE,
  PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE,
  PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL,
  PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32,
  PS_MITIGATION_OPTION_RETURN_FLOW_GUARD,
  PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY,
  PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD,
  PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT
} PS_MITIGATION_OPTION;

typedef enum _PS_CREATE_STATE {
  PsCreateInitialState,
  PsCreateFailOnFileOpen,
  PsCreateFailOnSectionCreate,
  PsCreateFailExeFormat,
  PsCreateFailMachineMismatch,
  PsCreateFailExeName,  // Debugger specified
  PsCreateSuccess,
  PsCreateMaximumStates
} PS_CREATE_STATE;

typedef struct _PS_CREATE_INFO {
  SIZE_T Size;
  PS_CREATE_STATE State;
  union {
    // PsCreateInitialState
    struct {
      union {
        ULONG InitFlags;
        struct {
          UCHAR WriteOutputOnExit : 1;
          UCHAR DetectManifest : 1;
          UCHAR IFEOSkipDebugger : 1;
          UCHAR IFEODoNotPropagateKeyState : 1;
          UCHAR SpareBits1 : 4;
          UCHAR SpareBits2 : 8;
          USHORT ProhibitedImageCharacteristics : 16;
        } s1;
      } u1;
      ACCESS_MASK AdditionalFileAccess;
    } InitState;

    // PsCreateFailOnSectionCreate
    struct {
      HANDLE FileHandle;
    } FailSection;

    // PsCreateFailExeFormat
    struct {
      USHORT DllCharacteristics;
    } ExeFormat;

    // PsCreateFailExeName
    struct {
      HANDLE IFEOKey;
    } ExeName;

    // PsCreateSuccess
    struct {
      union {
        ULONG OutputFlags;
        struct {
          UCHAR ProtectedProcess : 1;
          UCHAR AddressSpaceOverride : 1;
          UCHAR DevOverrideEnabled : 1;  // From Image File Execution Options
          UCHAR ManifestDetected : 1;
          UCHAR ProtectedProcessLight : 1;
          UCHAR SpareBits1 : 3;
          UCHAR SpareBits2 : 8;
          USHORT SpareBits3 : 16;
        } s2;
      } u2;
      HANDLE FileHandle;
      HANDLE SectionHandle;
      ULONGLONG UserProcessParametersNative;
      ULONG UserProcessParametersWow64;
      ULONG CurrentParameterFlags;
      ULONGLONG PebAddressNative;
      ULONG PebAddressWow64;
      ULONGLONG ManifestAddress;
      ULONG ManifestSize;
    } SuccessState;
  };
} PS_CREATE_INFO, *PPS_CREATE_INFO;

#define PROCESS_CREATE_FLAGS_BREAKAWAY 0x00000001
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT 0x00000002
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES 0x00000004
#define PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE 0x00000008
#define PROCESS_CREATE_FLAGS_LARGE_PAGES 0x00000010

// Only usable with NtCreateUserProcess (Vista+):
#define PROCESS_CREATE_FLAGS_LARGE_PAGE_SYSTEM_DLL 0x00000020
#define PROCESS_CREATE_FLAGS_PROTECTED_PROCESS \
  0x00000040  // Only allowed if the calling process is itself protected
#define PROCESS_CREATE_FLAGS_CREATE_SESSION 0x00000080
#define PROCESS_CREATE_FLAGS_INHERIT_FROM_PARENT 0x00000100

typedef enum _MEMORY_RESERVE_TYPE {
  MemoryReserveUserApc,
  MemoryReserveIoCompletion,
  MemoryReserveTypeMax
} MEMORY_RESERVE_TYPE;

typedef struct _PROCESS_HANDLE_TRACING_ENABLE {
  ULONG Flags;
} PROCESS_HANDLE_TRACING_ENABLE, *PPROCESS_HANDLE_TRACING_ENABLE;

#define PROCESS_HANDLE_TRACING_MAX_SLOTS 0x20000

typedef struct _PROCESS_HANDLE_TRACING_ENABLE_EX {
  ULONG Flags;
  ULONG TotalSlots;
} PROCESS_HANDLE_TRACING_ENABLE_EX, *PPROCESS_HANDLE_TRACING_ENABLE_EX;

// Source: http://processhacker.sourceforge.net
typedef enum _PROCESSINFOCLASS {
  ProcessBasicInformation,  // q: PROCESS_BASIC_INFORMATION,
                            // PROCESS_EXTENDED_BASIC_INFORMATION
  ProcessQuotaLimits,       // qs: QUOTA_LIMITS, QUOTA_LIMITS_EX
  ProcessIoCounters,        // q: IO_COUNTERS
  ProcessVmCounters,        // q: VM_COUNTERS, VM_COUNTERS_EX, VM_COUNTERS_EX2
  ProcessTimes,             // q: KERNEL_USER_TIMES
  ProcessBasePriority,      // s: KPRIORITY
  ProcessRaisePriority,     // s: ULONG
  ProcessDebugPort,         // q: HANDLE
  ProcessExceptionPort,     // s: HANDLE
  ProcessAccessToken,       // s: PROCESS_ACCESS_TOKEN
  ProcessLdtInformation,    // qs: PROCESS_LDT_INFORMATION // 10
  ProcessLdtSize,           // s: PROCESS_LDT_SIZE
  ProcessDefaultHardErrorMode,  // qs: ULONG
  ProcessIoPortHandlers,        // (kernel-mode only)
  ProcessPooledUsageAndLimits,  // q: POOLED_USAGE_AND_LIMITS
  ProcessWorkingSetWatch,       // q: PROCESS_WS_WATCH_INFORMATION[]; s: void
  ProcessUserModeIOPL,
  ProcessEnableAlignmentFaultFixup,  // s: BOOLEAN
  ProcessPriorityClass,              // qs: PROCESS_PRIORITY_CLASS
  ProcessWx86Information,
  ProcessHandleCount,            // q: ULONG, PROCESS_HANDLE_INFORMATION // 20
  ProcessAffinityMask,           // s: KAFFINITY
  ProcessPriorityBoost,          // qs: ULONG
  ProcessDeviceMap,              // qs: PROCESS_DEVICEMAP_INFORMATION,
                                 // PROCESS_DEVICEMAP_INFORMATION_EX
  ProcessSessionInformation,     // q: PROCESS_SESSION_INFORMATION
  ProcessForegroundInformation,  // s: PROCESS_FOREGROUND_BACKGROUND
  ProcessWow64Information,       // q: ULONG_PTR
  ProcessImageFileName,          // q: UNICODE_STRING
  ProcessLUIDDeviceMapsEnabled,  // q: ULONG
  ProcessBreakOnTermination,     // qs: ULONG
  ProcessDebugObjectHandle,      // q: HANDLE // 30
  ProcessDebugFlags,             // qs: ULONG
  ProcessHandleTracing,  // q: PROCESS_HANDLE_TRACING_QUERY; s: size 0 disables,
                         // otherwise enables
  ProcessIoPriority,     // qs: IO_PRIORITY_HINT
  ProcessExecuteFlags,   // qs: ULONG
  ProcessResourceManagement,
  ProcessCookie,            // q: ULONG
  ProcessImageInformation,  // q: SECTION_IMAGE_INFORMATION
  ProcessCycleTime,         // q: PROCESS_CYCLE_TIME_INFORMATION // since VISTA
  ProcessPagePriority,      // q: ULONG
  ProcessInstrumentationCallback,  // 40
  ProcessThreadStackAllocation,    // s: PROCESS_STACK_ALLOCATION_INFORMATION,
                                   // PROCESS_STACK_ALLOCATION_INFORMATION_EX
  ProcessWorkingSetWatchEx,        // q: PROCESS_WS_WATCH_INFORMATION_EX[]
  ProcessImageFileNameWin32,       // q: UNICODE_STRING
  ProcessImageFileMapping,         // q: HANDLE (input)
  ProcessAffinityUpdateMode,       // qs: PROCESS_AFFINITY_UPDATE_MODE
  ProcessMemoryAllocationMode,     // qs: PROCESS_MEMORY_ALLOCATION_MODE
  ProcessGroupInformation,         // q: USHORT[]
  ProcessTokenVirtualizationEnabled,  // s: ULONG
  ProcessConsoleHostProcess,          // q: ULONG_PTR
  ProcessWindowInformation,           // q: PROCESS_WINDOW_INFORMATION // 50
  ProcessHandleInformation,  // q: PROCESS_HANDLE_SNAPSHOT_INFORMATION // since
                             // WIN8
  ProcessMitigationPolicy,   // s: PROCESS_MITIGATION_POLICY_INFORMATION
  ProcessDynamicFunctionTableInformation,
  ProcessHandleCheckingMode,
  ProcessKeepAliveCount,     // q: PROCESS_KEEPALIVE_COUNT_INFORMATION
  ProcessRevokeFileHandles,  // s: PROCESS_REVOKE_FILE_HANDLES_INFORMATION
  ProcessWorkingSetControl,  // s: PROCESS_WORKING_SET_CONTROL
  ProcessHandleTable,        // since WINBLUE
  ProcessCheckStackExtentsMode,
  ProcessCommandLineInformation,  // q: UNICODE_STRING // 60
  ProcessProtectionInformation,   // q: PS_PROTECTION
  ProcessMemoryExhaustion,  // PROCESS_MEMORY_EXHAUSTION_INFO // since THRESHOLD
  ProcessFaultInformation,  // PROCESS_FAULT_INFORMATION
  ProcessTelemetryIdInformation,    // PROCESS_TELEMETRY_ID_INFORMATION
  ProcessCommitReleaseInformation,  // PROCESS_COMMIT_RELEASE_INFORMATION
  ProcessDefaultCpuSetsInformation,
  ProcessAllowedCpuSetsInformation,
  ProcessSubsystemProcess,
  ProcessJobMemoryInformation,  // PROCESS_JOB_MEMORY_INFO
  ProcessInPrivate,             // since THRESHOLD2 // 70
  ProcessRaiseUMExceptionOnInvalidHandleClose,
  ProcessIumChallengeResponse,
  ProcessChildProcessInformation,  // PROCESS_CHILD_PROCESS_INFORMATION
  ProcessHighGraphicsPriorityInformation,
  ProcessSubsystemInformation,  // q: SUBSYSTEM_INFORMATION_TYPE // since
                                // REDSTONE2
  ProcessEnergyValues,  // PROCESS_ENERGY_VALUES, PROCESS_EXTENDED_ENERGY_VALUES
  ProcessActivityThrottleState,   // PROCESS_ACTIVITY_THROTTLE_STATE
  ProcessActivityThrottlePolicy,  // PROCESS_ACTIVITY_THROTTLE_POLICY
  ProcessWin32kSyscallFilterInformation,
  ProcessDisableSystemAllowedCpuSets,
  ProcessWakeInformation,      // PROCESS_WAKE_INFORMATION
  ProcessEnergyTrackingState,  // PROCESS_ENERGY_TRACKING_STATE
  MaxProcessInfoClass
} PROCESSINFOCLASS;

// Source: http://processhacker.sourceforge.net
typedef enum _SYSTEM_INFORMATION_CLASS {
  SystemBasicInformation,                 // q: SYSTEM_BASIC_INFORMATION
  SystemProcessorInformation,             // q: SYSTEM_PROCESSOR_INFORMATION
  SystemPerformanceInformation,           // q: SYSTEM_PERFORMANCE_INFORMATION
  SystemTimeOfDayInformation,             // q: SYSTEM_TIMEOFDAY_INFORMATION
  SystemPathInformation,                  // not implemented
  SystemProcessInformation,               // q: SYSTEM_PROCESS_INFORMATION
  SystemCallCountInformation,             // q: SYSTEM_CALL_COUNT_INFORMATION
  SystemDeviceInformation,                // q: SYSTEM_DEVICE_INFORMATION
  SystemProcessorPerformanceInformation,  // q:
                                          // SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
  SystemFlagsInformation,     // q: SYSTEM_FLAGS_INFORMATION
  SystemCallTimeInformation,  // not implemented // SYSTEM_CALL_TIME_INFORMATION
                              // // 10
  SystemModuleInformation,    // q: RTL_PROCESS_MODULES
  SystemLocksInformation,     // q: RTL_PROCESS_LOCKS
  SystemStackTraceInformation,    // q: RTL_PROCESS_BACKTRACES
  SystemPagedPoolInformation,     // not implemented
  SystemNonPagedPoolInformation,  // not implemented
  SystemHandleInformation,        // q: SYSTEM_HANDLE_INFORMATION
  SystemObjectInformation,        // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with
                                  // SYSTEM_OBJECT_INFORMATION
  SystemPageFileInformation,      // q: SYSTEM_PAGEFILE_INFORMATION
  SystemVdmInstemulInformation,   // q
  SystemVdmBopInformation,        // not implemented // 20
  SystemFileCacheInformation,    // q: SYSTEM_FILECACHE_INFORMATION; s (requires
                                 // SeIncreaseQuotaPrivilege) (info for
                                 // WorkingSetTypeSystemCache)
  SystemPoolTagInformation,      // q: SYSTEM_POOLTAG_INFORMATION
  SystemInterruptInformation,    // q: SYSTEM_INTERRUPT_INFORMATION
  SystemDpcBehaviorInformation,  // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s:
                                 // SYSTEM_DPC_BEHAVIOR_INFORMATION (requires
                                 // SeLoadDriverPrivilege)
  SystemFullMemoryInformation,   // not implemented
  SystemLoadGdiDriverInformation,    // s (kernel-mode only)
  SystemUnloadGdiDriverInformation,  // s (kernel-mode only)
  SystemTimeAdjustmentInformation,   // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION;
                                     // s: SYSTEM_SET_TIME_ADJUST_INFORMATION
                                     // (requires SeSystemtimePrivilege)
  SystemSummaryMemoryInformation,    // not implemented
  SystemMirrorMemoryInformation,     // s (requires license value
                                     // "Kernel-MemoryMirroringSupported")
                                     // (requires SeShutdownPrivilege) // 30
  SystemPerformanceTraceInformation,  // q; s: (type depends on
                                      // EVENT_TRACE_INFORMATION_CLASS)
  SystemObsolete0,                    // not implemented
  SystemExceptionInformation,         // q: SYSTEM_EXCEPTION_INFORMATION
  SystemCrashDumpStateInformation,    // s (requires SeDebugPrivilege)
  SystemKernelDebuggerInformation,    // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
  SystemContextSwitchInformation,     // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
  SystemRegistryQuotaInformation,     // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s
                                      // (requires SeIncreaseQuotaPrivilege)
  SystemExtendServiceTableInformation,  // s (requires SeLoadDriverPrivilege) //
                                        // loads win32k only
  SystemPrioritySeperation,             // s (requires SeTcbPrivilege)
  SystemVerifierAddDriverInformation,   // s (requires SeDebugPrivilege) // 40
  SystemVerifierRemoveDriverInformation,  // s (requires SeDebugPrivilege)
  SystemProcessorIdleInformation,    // q: SYSTEM_PROCESSOR_IDLE_INFORMATION
  SystemLegacyDriverInformation,     // q: SYSTEM_LEGACY_DRIVER_INFORMATION
  SystemCurrentTimeZoneInformation,  // q
  SystemLookasideInformation,        // q: SYSTEM_LOOKASIDE_INFORMATION
  SystemTimeSlipNotification,        // s (requires SeSystemtimePrivilege)
  SystemSessionCreate,               // not implemented
  SystemSessionDetach,               // not implemented
  SystemSessionInformation,          // not implemented
  SystemRangeStartInformation,       // q: SYSTEM_RANGE_START_INFORMATION // 50
  SystemVerifierInformation,  // q: SYSTEM_VERIFIER_INFORMATION; s (requires
                              // SeDebugPrivilege)
  SystemVerifierThunkExtend,  // s (kernel-mode only)
  SystemSessionProcessInformation,   // q: SYSTEM_SESSION_PROCESS_INFORMATION
  SystemLoadGdiDriverInSystemSpace,  // s (kernel-mode only) (same as
                                     // SystemLoadGdiDriverInformation)
  SystemNumaProcessorMap,            // q
  SystemPrefetcherInformation,       // q: PREFETCHER_INFORMATION; s:
                                     // PREFETCHER_INFORMATION //
                                     // PfSnQueryPrefetcherInformation
  SystemExtendedProcessInformation,  // q: SYSTEM_PROCESS_INFORMATION
  SystemRecommendedSharedDataAlignment,  // q
  SystemComPlusPackage,                  // q; s
  SystemNumaAvailableMemory,             // 60
  SystemProcessorPowerInformation,  // q: SYSTEM_PROCESSOR_POWER_INFORMATION
  SystemEmulationBasicInformation,  // q
  SystemEmulationProcessorInformation,
  SystemExtendedHandleInformation,     // q: SYSTEM_HANDLE_INFORMATION_EX
  SystemLostDelayedWriteInformation,   // q: ULONG
  SystemBigPoolInformation,            // q: SYSTEM_BIGPOOL_INFORMATION
  SystemSessionPoolTagInformation,     // q: SYSTEM_SESSION_POOLTAG_INFORMATION
  SystemSessionMappedViewInformation,  // q:
                                       // SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
  SystemHotpatchInformation,           // q; s
  SystemObjectSecurityMode,            // q // 70
  SystemWatchdogTimerHandler,          // s (kernel-mode only)
  SystemWatchdogTimerInformation,  // q (kernel-mode only); s (kernel-mode only)
  SystemLogicalProcessorInformation,  // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION
  SystemWow64SharedInformationObsolete,           // not implemented
  SystemRegisterFirmwareTableInformationHandler,  // s (kernel-mode only)
  SystemFirmwareTableInformation,   // SYSTEM_FIRMWARE_TABLE_INFORMATION
  SystemModuleInformationEx,        // q: RTL_PROCESS_MODULE_INFORMATION_EX
  SystemVerifierTriageInformation,  // not implemented
  SystemSuperfetchInformation,      // q; s: SUPERFETCH_INFORMATION //
                                    // PfQuerySuperfetchInformation
  SystemMemoryListInformation,      // q: SYSTEM_MEMORY_LIST_INFORMATION; s:
                                    // SYSTEM_MEMORY_LIST_COMMAND (requires
                                    // SeProfileSingleProcessPrivilege) // 80
  SystemFileCacheInformationEx,  // q: SYSTEM_FILECACHE_INFORMATION; s (requires
                                 // SeIncreaseQuotaPrivilege) (same as
                                 // SystemFileCacheInformation)
  SystemThreadPriorityClientIdInformation,  // s:
                                            // SYSTEM_THREAD_CID_PRIORITY_INFORMATION
                                            // (requires
                                            // SeIncreaseBasePriorityPrivilege)
  SystemProcessorIdleCycleTimeInformation,  // q:
                                            // SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]
  SystemVerifierCancellationInformation,  // not implemented //
                                          // name:wow64:whNT32QuerySystemVerifierCancellationInformation
  SystemProcessorPowerInformationEx,  // not implemented
  SystemRefTraceInformation,          // q; s: SYSTEM_REF_TRACE_INFORMATION //
                                      // ObQueryRefTraceInformation
  SystemSpecialPoolInformation,       // q; s (requires SeDebugPrivilege) //
                                      // MmSpecialPoolTag, then
                                      // MmSpecialPoolCatchOverruns != 0
  SystemProcessIdInformation,         // q: SYSTEM_PROCESS_ID_INFORMATION
  SystemErrorPortInformation,         // s (requires SeTcbPrivilege)
  SystemBootEnvironmentInformation,   // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION
                                      // // 90
  SystemHypervisorInformation,        // q; s (kernel-mode only)
  SystemVerifierInformationEx,        // q; s: SYSTEM_VERIFIER_INFORMATION_EX
  SystemTimeZoneInformation,          // s (requires SeTimeZonePrivilege)
  SystemImageFileExecutionOptionsInformation,  // s:
                                               // SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION
                                               // (requires SeTcbPrivilege)
  SystemCoverageInformation,  // q; s //
                              // name:wow64:whNT32QuerySystemCoverageInformation;
                              // ExpCovQueryInformation
  SystemPrefetchPatchInformation,    // not implemented
  SystemVerifierFaultsInformation,   // s (requires SeDebugPrivilege)
  SystemSystemPartitionInformation,  // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
  SystemSystemDiskInformation,       // q: SYSTEM_SYSTEM_DISK_INFORMATION
  SystemProcessorPerformanceDistribution,  // q:
                                           // SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION
                                           // // 100
  SystemNumaProximityNodeInformation,  // q
  SystemDynamicTimeZoneInformation,    // q; s (requires SeTimeZonePrivilege)
  SystemCodeIntegrityInformation,      // q: SYSTEM_CODEINTEGRITY_INFORMATION //
                                       // SeCodeIntegrityQueryInformation
  SystemProcessorMicrocodeUpdateInformation,  // s
  SystemProcessorBrandString,  // q // HaliQuerySystemInformation ->
                               // HalpGetProcessorBrandString, info class 23
  SystemVirtualAddressInformation,  // q: SYSTEM_VA_LIST_INFORMATION[]; s:
                                    // SYSTEM_VA_LIST_INFORMATION[] (requires
                                    // SeIncreaseQuotaPrivilege) //
                                    // MmQuerySystemVaInformation
  SystemLogicalProcessorAndGroupInformation,  // q:
                                              // SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX
                                              // // since WIN7 //
                                              // KeQueryLogicalProcessorRelationship
  SystemProcessorCycleTimeInformation,  // q:
                                        // SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]
  SystemStoreInformation,      // q; s // SmQueryStoreInformation
  SystemRegistryAppendString,  // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS //
                               // 110
  SystemAitSamplingValue,      // s: ULONG (requires
                               // SeProfileSingleProcessPrivilege)
  SystemVhdBootInformation,    // q: SYSTEM_VHD_BOOT_INFORMATION
  SystemCpuQuotaInformation,   // q; s // PsQueryCpuQuotaInformation
  SystemNativeBasicInformation,       // not implemented
  SystemSpare1,                       // not implemented
  SystemLowPriorityIoInformation,     // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
  SystemTpmBootEntropyInformation,    // q: TPM_BOOT_ENTROPY_NT_RESULT //
                                      // ExQueryTpmBootEntropyInformation
  SystemVerifierCountersInformation,  // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
  SystemPagedPoolInformationEx,  // q: SYSTEM_FILECACHE_INFORMATION; s (requires
                                 // SeIncreaseQuotaPrivilege) (info for
                                 // WorkingSetTypePagedPool)
  SystemSystemPtesInformationEx,  // q: SYSTEM_FILECACHE_INFORMATION; s
                                  // (requires SeIncreaseQuotaPrivilege) (info
                                  // for WorkingSetTypeSystemPtes) // 120
  SystemNodeDistanceInformation,  // q
  SystemAcpiAuditInformation,     // q: SYSTEM_ACPI_AUDIT_INFORMATION //
                                  // HaliQuerySystemInformation ->
                                  // HalpAuditQueryResults, info class 26
  SystemBasicPerformanceInformation,  // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION
                                      // //
                                      // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
  SystemQueryPerformanceCounterInformation,  // q:
                                             // SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION
                                             // // since WIN7 SP1
  SystemSessionBigPoolInformation,  // q: SYSTEM_SESSION_POOLTAG_INFORMATION //
                                    // since WIN8
  SystemBootGraphicsInformation,    // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION
                                    // (kernel-mode only)
  SystemScrubPhysicalMemoryInformation,  // q; s: MEMORY_SCRUB_INFORMATION
  SystemBadPageInformation,
  SystemProcessorProfileControlArea,  // q; s:
                                      // SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
  SystemCombinePhysicalMemoryInformation,  // s: MEMORY_COMBINE_INFORMATION,
                                           // MEMORY_COMBINE_INFORMATION_EX,
                                           // MEMORY_COMBINE_INFORMATION_EX2 //
                                           // 130
  SystemEntropyInterruptTimingCallback,
  SystemConsoleInformation,         // q: SYSTEM_CONSOLE_INFORMATION
  SystemPlatformBinaryInformation,  // q: SYSTEM_PLATFORM_BINARY_INFORMATION
  SystemThrottleNotificationInformation,
  SystemHypervisorProcessorCountInformation,  // q:
                                              // SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
  SystemDeviceDataInformation,  // q: SYSTEM_DEVICE_DATA_INFORMATION
  SystemDeviceDataEnumerationInformation,
  SystemMemoryTopologyInformation,  // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
  SystemMemoryChannelInformation,   // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
  SystemBootLogoInformation,        // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
  SystemProcessorPerformanceInformationEx,  // q:
                                            // SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX
                                            // // since WINBLUE
  SystemSpare0,
  SystemSecureBootPolicyInformation,  // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
  SystemPageFileInformationEx,        // q: SYSTEM_PAGEFILE_INFORMATION_EX
  SystemSecureBootInformation,        // q: SYSTEM_SECUREBOOT_INFORMATION
  SystemEntropyInterruptTimingRawInformation,
  SystemPortableWorkspaceEfiLauncherInformation,  // q:
                                                  // SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
  SystemFullProcessInformation,       // q: SYSTEM_PROCESS_INFORMATION with
                                      // SYSTEM_PROCESS_INFORMATION_EXTENSION
                                      // (requires admin)
  SystemKernelDebuggerInformationEx,  // q:
                                      // SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
  SystemBootMetadataInformation,      // 150
  SystemSoftRebootInformation,
  SystemElamCertificateInformation,  // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
  SystemOfflineDumpConfigInformation,
  SystemProcessorFeaturesInformation,  // q:
                                       // SYSTEM_PROCESSOR_FEATURES_INFORMATION
  SystemRegistryReconciliationInformation,
  SystemEdidInformation,
  SystemManufacturingInformation,  // q: SYSTEM_MANUFACTURING_INFORMATION //
                                   // since THRESHOLD
  SystemEnergyEstimationConfigInformation,  // q:
                                            // SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
  SystemHypervisorDetailInformation,  // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
  SystemProcessorCycleStatsInformation,  // q:
                                         // SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION
                                         // // 160
  SystemVmGenerationCountInformation,
  SystemTrustedPlatformModuleInformation,  // q: SYSTEM_TPM_INFORMATION
  SystemKernelDebuggerFlags,
  SystemCodeIntegrityPolicyInformation,  // q:
                                         // SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
  SystemIsolatedUserModeInformation,  // q:
                                      // SYSTEM_ISOLATED_USER_MODE_INFORMATION
  SystemHardwareSecurityTestInterfaceResultsInformation,
  SystemSingleModuleInformation,  // q: SYSTEM_SINGLE_MODULE_INFORMATION
  SystemAllowedCpuSetsInformation,
  SystemDmaProtectionInformation,     // q: SYSTEM_DMA_PROTECTION_INFORMATION
  SystemInterruptCpuSetsInformation,  // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION
                                      // // 170
  SystemSecureBootPolicyFullInformation,  // q:
                                          // SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
  SystemCodeIntegrityPolicyFullInformation,
  SystemAffinitizedInterruptProcessorInformation,
  SystemRootSiloInformation,  // q: SYSTEM_ROOT_SILO_INFORMATION
  SystemCpuSetInformation,  // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
  SystemCpuSetTagInformation,  // q: SYSTEM_CPU_SET_TAG_INFORMATION
  SystemWin32WerStartCallout,
  SystemSecureKernelProfileInformation,  // q:
                                         // SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
  SystemCodeIntegrityPlatformManifestInformation,  // q:
                                                   // SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION
                                                   // // since REDSTONE
  SystemInterruptSteeringInformation,  // 180
  SystemSupportedProcessorArchitectures,
  SystemMemoryUsageInformation,  // q: SYSTEM_MEMORY_USAGE_INFORMATION
  SystemCodeIntegrityCertificateInformation,  // q:
                                              // SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
  SystemPhysicalMemoryInformation,  // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION //
                                    // since REDSTONE2
  SystemControlFlowTransition,
  SystemKernelDebuggingAllowed,
  SystemActivityModerationExeState,      // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
  SystemActivityModerationUserSettings,  // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
  SystemCodeIntegrityPoliciesFullInformation,
  SystemCodeIntegrityUnlockInformation,  // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION
                                         // // 190
  SystemIntegrityQuotaInformation,
  SystemFlushInformation,  // q: SYSTEM_FLUSH_INFORMATION
  MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS;

typedef enum _OBJECT_INFORMATION_CLASS {
  ObjectBasicInformation,       // OBJECT_BASIC_INFORMATION
  ObjectNameInformation,        // OBJECT_NAME_INFORMATION
  ObjectTypeInformation,        // OBJECT_TYPE_INFORMATION
  ObjectTypesInformation,       // OBJECT_TYPES_INFORMATION
  ObjectHandleFlagInformation,  // OBJECT_HANDLE_FLAG_INFORMATION
  ObjectSessionInformation,
  ObjectSessionObjectInformation,
  MaxObjectInfoClass
} OBJECT_INFORMATION_CLASS;

// Source: http://processhacker.sourceforge.net
typedef enum _THREADINFOCLASS {
  ThreadBasicInformation,           // q: THREAD_BASIC_INFORMATION
  ThreadTimes,                      // q: KERNEL_USER_TIMES
  ThreadPriority,                   // s: KPRIORITY
  ThreadBasePriority,               // s: LONG
  ThreadAffinityMask,               // s: KAFFINITY
  ThreadImpersonationToken,         // s: HANDLE
  ThreadDescriptorTableEntry,       // q: DESCRIPTOR_TABLE_ENTRY (or
                                    // WOW64_DESCRIPTOR_TABLE_ENTRY)
  ThreadEnableAlignmentFaultFixup,  // s: BOOLEAN
  ThreadEventPair,
  ThreadQuerySetWin32StartAddress,  // q: PVOID
  ThreadZeroTlsCell,                // 10
  ThreadPerformanceCount,           // q: LARGE_INTEGER
  ThreadAmILastThread,              // q: ULONG
  ThreadIdealProcessor,             // s: ULONG
  ThreadPriorityBoost,              // qs: ULONG
  ThreadSetTlsArrayAddress,
  ThreadIsIoPending,         // q: ULONG
  ThreadHideFromDebugger,    // s: void
  ThreadBreakOnTermination,  // qs: ULONG
  ThreadSwitchLegacyState,
  ThreadIsTerminated,    // q: ULONG // 20
  ThreadLastSystemCall,  // q: THREAD_LAST_SYSCALL_INFORMATION
  ThreadIoPriority,      // qs: IO_PRIORITY_HINT
  ThreadCycleTime,       // q: THREAD_CYCLE_TIME_INFORMATION
  ThreadPagePriority,    // q: ULONG
  ThreadActualBasePriority,
  ThreadTebInformation,  // q: THREAD_TEB_INFORMATION (requires
                         // THREAD_GET_CONTEXT + THREAD_SET_CONTEXT)
  ThreadCSwitchMon,
  ThreadCSwitchPmu,
  ThreadWow64Context,      // q: WOW64_CONTEXT
  ThreadGroupInformation,  // q: GROUP_AFFINITY // 30
  ThreadUmsInformation,    // q: THREAD_UMS_INFORMATION
  ThreadCounterProfiling,
  ThreadIdealProcessorEx,          // q: PROCESSOR_NUMBER
  ThreadCpuAccountingInformation,  // since WIN8
  ThreadSuspendCount,              // since WINBLUE
  ThreadHeterogeneousCpuPolicy,    // q: KHETERO_CPU_POLICY // since THRESHOLD
  ThreadContainerId,               // q: GUID
  ThreadNameInformation,           // qs: THREAD_NAME_INFORMATION
  ThreadSelectedCpuSets,
  ThreadSystemThreadInformation,  // q: SYSTEM_THREAD_INFORMATION // 40
  ThreadActualGroupAffinity,      // since THRESHOLD2
  ThreadDynamicCodePolicyInfo,
  ThreadExplicitCaseSensitivity,
  ThreadWorkOnBehalfTicket,
  ThreadSubsystemInformation,  // q: SUBSYSTEM_INFORMATION_TYPE // since
                               // REDSTONE2
  ThreadDbgkWerReportActive,
  ThreadAttachContainer,
  MaxThreadInfoClass
} THREADINFOCLASS;

typedef enum _FSINFOCLASS {
  FileFsVolumeInformation = 1,        // FILE_FS_VOLUME_INFORMATION
  FileFsLabelInformation = 2,         // FILE_FS_LABEL_INFORMATION
  FileFsSizeInformation = 3,          // FILE_FS_SIZE_INFORMATION
  FileFsDeviceInformation = 4,        // FILE_FS_DEVICE_INFORMATION
  FileFsAttributeInformation = 5,     // FILE_FS_ATTRIBUTE_INFORMATION
  FileFsControlInformation = 6,       // FILE_FS_CONTROL_INFORMATION
  FileFsFullSizeInformation = 7,      // FILE_FS_FULL_SIZE_INFORMATION
  FileFsObjectIdInformation = 8,      // FILE_FS_OBJECTID_INFORMATION
  FileFsDriverPathInformation = 9,    // FILE_FS_DRIVER_PATH_INFORMATION
  FileFsVolumeFlagsInformation = 10,  // FILE_FS_VOLUME_FLAGS_INFORMATION
  FileFsSectorSizeInformation =
      11,  // FILE_FS_SECTOR_SIZE_INFORMATION // since WIN8
  FileFsDataCopyInformation = 12,  // FILE_FS_DATA_COPY_INFORMATION
  FileFsMetadataSizeInformation =
      13,  // FILE_FS_METADATA_SIZE_INFORMATION // since THRESHOLD
  FileFsMaximumInformation
} FS_INFORMATION_CLASS,
    *PFS_INFORMATION_CLASS;

typedef enum _MEMORY_INFORMATION_CLASS {
  MemoryBasicInformation,           // MEMORY_BASIC_INFORMATION
  MemoryWorkingSetInformation,      // MEMORY_WORKING_SET_INFORMATION
  MemoryMappedFilenameInformation,  // UNICODE_STRING
  MemoryRegionInformation,          // MEMORY_REGION_INFORMATION
  MemoryWorkingSetExInformation,    // MEMORY_WORKING_SET_EX_INFORMATION
  MemorySharedCommitInformation,    // MEMORY_SHARED_COMMIT_INFORMATION
  MemoryImageInformation,           // MEMORY_IMAGE_INFORMATION
  MemoryRegionInformationEx,
  MemoryPrivilegedBasicInformation
} MEMORY_INFORMATION_CLASS;

typedef enum _SECTION_INFORMATION_CLASS {
  SectionBasicInformation,
  SectionImageInformation,
  SectionRelocationInformation,  // name:wow64:whNtQuerySection_SectionRelocationInformation
  SectionOriginalBaseInformation,   // PVOID BaseAddress
  SectionInternalImageInformation,  // SECTION_INTERNAL_IMAGE_INFORMATION //
                                    // since REDSTONE2
  MaxSectionInfoClass
} SECTION_INFORMATION_CLASS;

// Boot condition flags (NtInitializeRegistry)
#define REG_INIT_BOOT_SM 0x0000
#define REG_INIT_BOOT_SETUP 0x0001
#define REG_INIT_BOOT_ACCEPTED_BASE 0x0002
#define REG_INIT_BOOT_ACCEPTED_MAX REG_INIT_BOOT_ACCEPTED_BASE + 999

#define REG_MAX_KEY_VALUE_NAME_LENGTH 32767
#define REG_MAX_KEY_NAME_LENGTH 512

typedef enum _KEY_INFORMATION_CLASS {
  KeyBasicInformation,           // KEY_BASIC_INFORMATION
  KeyNodeInformation,            // KEY_NODE_INFORMATION
  KeyFullInformation,            // KEY_FULL_INFORMATION
  KeyNameInformation,            // KEY_NAME_INFORMATION
  KeyCachedInformation,          // KEY_CACHED_INFORMATION
  KeyFlagsInformation,           // KEY_FLAGS_INFORMATION
  KeyVirtualizationInformation,  // KEY_VIRTUALIZATION_INFORMATION
  KeyHandleTagsInformation,      // KEY_HANDLE_TAGS_INFORMATION
  KeyTrustInformation,           // KEY_TRUST_INFORMATION
  KeyLayerInformation,           // KEY_LAYER_INFORMATION
  MaxKeyInfoClass
} KEY_INFORMATION_CLASS;

typedef struct _KEY_BASIC_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG TitleIndex;
  ULONG NameLength;
  WCHAR Name[1];
} KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION;

typedef struct _KEY_NODE_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG TitleIndex;
  ULONG ClassOffset;
  ULONG ClassLength;
  ULONG NameLength;
  WCHAR Name[1];
  // ...
  // WCHAR Class[1];
} KEY_NODE_INFORMATION, *PKEY_NODE_INFORMATION;

typedef struct _KEY_FULL_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG TitleIndex;
  ULONG ClassOffset;
  ULONG ClassLength;
  ULONG SubKeys;
  ULONG MaxNameLen;
  ULONG MaxClassLen;
  ULONG Values;
  ULONG MaxValueNameLen;
  ULONG MaxValueDataLen;
  WCHAR Class[1];
} KEY_FULL_INFORMATION, *PKEY_FULL_INFORMATION;

typedef struct _KEY_NAME_INFORMATION {
  ULONG NameLength;
  WCHAR Name[1];
} KEY_NAME_INFORMATION, *PKEY_NAME_INFORMATION;

typedef struct _KEY_CACHED_INFORMATION {
  LARGE_INTEGER LastWriteTime;
  ULONG TitleIndex;
  ULONG SubKeys;
  ULONG MaxNameLen;
  ULONG Values;
  ULONG MaxValueNameLen;
  ULONG MaxValueDataLen;
  ULONG NameLength;
  WCHAR Name[1];
} KEY_CACHED_INFORMATION, *PKEY_CACHED_INFORMATION;

typedef struct _KEY_FLAGS_INFORMATION {
  ULONG UserFlags;
} KEY_FLAGS_INFORMATION, *PKEY_FLAGS_INFORMATION;

typedef struct _KEY_VIRTUALIZATION_INFORMATION {
  ULONG VirtualizationCandidate : 1;  // Tells whether the key is part of the
                                      // virtualization namespace scope (only
                                      // HKLM\Software for now).
  ULONG
      VirtualizationEnabled : 1;  // Tells whether virtualization is enabled on
                                  // this key. Can be 1 only if above flag is 1.
  ULONG VirtualTarget : 1;  // Tells if the key is a virtual key. Can be 1 only
                            // if above 2 are 0. Valid only on the virtual store
                            // key handles.
  ULONG VirtualStore : 1;   // Tells if the key is a part of the virtual store
                           // path. Valid only on the virtual store key handles.
  ULONG VirtualSource : 1;  // Tells if the key has ever been virtualized, can
                            // be 1 only if VirtualizationCandidate is 1.
  ULONG Reserved : 27;
} KEY_VIRTUALIZATION_INFORMATION, *PKEY_VIRTUALIZATION_INFORMATION;

// private
typedef struct _KEY_TRUST_INFORMATION {
  ULONG TrustedKey : 1;
  ULONG Reserved : 31;
} KEY_TRUST_INFORMATION, *PKEY_TRUST_INFORMATION;

// private
typedef struct _KEY_LAYER_INFORMATION {
  ULONG IsTombstone;
  ULONG IsSupersedeLocal;
  ULONG IsSupersedeTree;
  ULONG ClassIsInherited;
  ULONG Reserved;
} KEY_LAYER_INFORMATION, *PKEY_LAYER_INFORMATION;

typedef enum _KEY_SET_INFORMATION_CLASS {
  KeyWriteTimeInformation,          // KEY_WRITE_TIME_INFORMATION
  KeyWow64FlagsInformation,         // KEY_WOW64_FLAGS_INFORMATION
  KeyControlFlagsInformation,       // KEY_CONTROL_FLAGS_INFORMATION
  KeySetVirtualizationInformation,  // KEY_SET_VIRTUALIZATION_INFORMATION
  KeySetDebugInformation,
  KeySetHandleTagsInformation,  // KEY_HANDLE_TAGS_INFORMATION
  MaxKeySetInfoClass
} KEY_SET_INFORMATION_CLASS;

typedef struct _KEY_WRITE_TIME_INFORMATION {
  LARGE_INTEGER LastWriteTime;
} KEY_WRITE_TIME_INFORMATION, *PKEY_WRITE_TIME_INFORMATION;

typedef struct _KEY_WOW64_FLAGS_INFORMATION {
  ULONG UserFlags;
} KEY_WOW64_FLAGS_INFORMATION, *PKEY_WOW64_FLAGS_INFORMATION;

typedef struct _KEY_HANDLE_TAGS_INFORMATION {
  ULONG HandleTags;
} KEY_HANDLE_TAGS_INFORMATION, *PKEY_HANDLE_TAGS_INFORMATION;

typedef struct _KEY_CONTROL_FLAGS_INFORMATION {
  ULONG ControlFlags;
} KEY_CONTROL_FLAGS_INFORMATION, *PKEY_CONTROL_FLAGS_INFORMATION;

typedef struct _KEY_SET_VIRTUALIZATION_INFORMATION {
  ULONG VirtualTarget : 1;
  ULONG VirtualStore : 1;
  ULONG VirtualSource : 1;  // true if key has been virtualized at least once
  ULONG Reserved : 29;
} KEY_SET_VIRTUALIZATION_INFORMATION, *PKEY_SET_VIRTUALIZATION_INFORMATION;

typedef enum _KEY_VALUE_INFORMATION_CLASS {
  KeyValueBasicInformation,    // KEY_VALUE_BASIC_INFORMATION
  KeyValueFullInformation,     // KEY_VALUE_FULL_INFORMATION
  KeyValuePartialInformation,  // KEY_VALUE_PARTIAL_INFORMATION
  KeyValueFullInformationAlign64,
  KeyValuePartialInformationAlign64,  // KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
  KeyValueLayerInformation,           // KEY_VALUE_LAYER_INFORMATION
  MaxKeyValueInfoClass
} KEY_VALUE_INFORMATION_CLASS;

typedef struct _KEY_VALUE_BASIC_INFORMATION {
  ULONG TitleIndex;
  ULONG Type;
  ULONG NameLength;
  WCHAR Name[1];
} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;

typedef struct _KEY_VALUE_FULL_INFORMATION {
  ULONG TitleIndex;
  ULONG Type;
  ULONG DataOffset;
  ULONG DataLength;
  ULONG NameLength;
  WCHAR Name[1];
  // ...
  // UCHAR Data[1];
} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;

typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
  ULONG TitleIndex;
  ULONG Type;
  ULONG DataLength;
  UCHAR Data[1];
} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;

typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 {
  ULONG Type;
  ULONG DataLength;
  UCHAR Data[1];
} KEY_VALUE_PARTIAL_INFORMATION_ALIGN64,
    *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64;

// private
typedef struct _KEY_VALUE_LAYER_INFORMATION {
  ULONG IsTombstone;
  ULONG Reserved;
} KEY_VALUE_LAYER_INFORMATION, *PKEY_VALUE_LAYER_INFORMATION;

typedef struct _KEY_VALUE_ENTRY {
  PUNICODE_STRING ValueName;
  ULONG DataLength;
  ULONG DataOffset;
  ULONG Type;
} KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY;

typedef enum _REG_ACTION { KeyAdded, KeyRemoved, KeyModified } REG_ACTION;

typedef struct _REG_NOTIFY_INFORMATION {
  ULONG NextEntryOffset;
  REG_ACTION Action;
  ULONG KeyLength;
  WCHAR Key[1];
} REG_NOTIFY_INFORMATION, *PREG_NOTIFY_INFORMATION;

typedef struct _KEY_PID_ARRAY {
  HANDLE PID;
  UNICODE_STRING KeyName;
} KEY_PID_ARRAY, *PKEY_PID_ARRAY;

typedef struct _KEY_OPEN_SUBKEYS_INFORMATION {
  ULONG Count;
  KEY_PID_ARRAY KeyArray[1];
} KEY_OPEN_SUBKEYS_INFORMATION, *PKEY_OPEN_SUBKEYS_INFORMATION;

typedef enum _SYSDBG_COMMAND {
  SysDbgQueryModuleInformation,
  SysDbgQueryTraceInformation,
  SysDbgSetTracepoint,
  SysDbgSetSpecialCall,
  SysDbgClearSpecialCalls,
  SysDbgQuerySpecialCalls,
  SysDbgBreakPoint,
  SysDbgQueryVersion,
  SysDbgReadVirtual,
  SysDbgWriteVirtual,
  SysDbgReadPhysical,
  SysDbgWritePhysical,
  SysDbgReadControlSpace,
  SysDbgWriteControlSpace,
  SysDbgReadIoSpace,
  SysDbgWriteIoSpace,
  SysDbgReadMsr,
  SysDbgWriteMsr,
  SysDbgReadBusData,
  SysDbgWriteBusData,
  SysDbgCheckLowMemory,
  SysDbgEnableKernelDebugger,
  SysDbgDisableKernelDebugger,
  SysDbgGetAutoKdEnable,
  SysDbgSetAutoKdEnable,
  SysDbgGetPrintBufferSize,
  SysDbgSetPrintBufferSize,
  SysDbgGetKdUmExceptionEnable,
  SysDbgSetKdUmExceptionEnable,
  SysDbgGetTriageDump,
  SysDbgGetKdBlockEnable,
  SysDbgSetKdBlockEnable,
  SysDbgRegisterForUmBreakInfo,
  SysDbgGetUmBreakPid,
  SysDbgClearUmBreakPid,
  SysDbgGetUmAttachPid,
  SysDbgClearUmAttachPid,
  SysDbgGetLiveKernelDump
} SYSDBG_COMMAND,
    *PSYSDBG_COMMAND;

typedef enum _DEBUGOBJECTINFOCLASS {
  DebugObjectFlags = 1,
  MaxDebugObjectInfoClass
} DEBUGOBJECTINFOCLASS,
    *PDEBUGOBJECTINFOCLASS;

// Source: http://processhacker.sourceforge.net
typedef enum _FILE_INFORMATION_CLASS {
  FileDirectoryInformation = 1,    // FILE_DIRECTORY_INFORMATION
  FileFullDirectoryInformation,    // FILE_FULL_DIR_INFORMATION
  FileBothDirectoryInformation,    // FILE_BOTH_DIR_INFORMATION
  FileBasicInformation,            // FILE_BASIC_INFORMATION
  FileStandardInformation,         // FILE_STANDARD_INFORMATION
  FileInternalInformation,         // FILE_INTERNAL_INFORMATION
  FileEaInformation,               // FILE_EA_INFORMATION
  FileAccessInformation,           // FILE_ACCESS_INFORMATION
  FileNameInformation,             // FILE_NAME_INFORMATION
  FileRenameInformation,           // FILE_RENAME_INFORMATION // 10
  FileLinkInformation,             // FILE_LINK_INFORMATION
  FileNamesInformation,            // FILE_NAMES_INFORMATION
  FileDispositionInformation,      // FILE_DISPOSITION_INFORMATION
  FilePositionInformation,         // FILE_POSITION_INFORMATION
  FileFullEaInformation,           // FILE_FULL_EA_INFORMATION
  FileModeInformation,             // FILE_MODE_INFORMATION
  FileAlignmentInformation,        // FILE_ALIGNMENT_INFORMATION
  FileAllInformation,              // FILE_ALL_INFORMATION
  FileAllocationInformation,       // FILE_ALLOCATION_INFORMATION
  FileEndOfFileInformation,        // FILE_END_OF_FILE_INFORMATION // 20
  FileAlternateNameInformation,    // FILE_NAME_INFORMATION
  FileStreamInformation,           // FILE_STREAM_INFORMATION
  FilePipeInformation,             // FILE_PIPE_INFORMATION
  FilePipeLocalInformation,        // FILE_PIPE_LOCAL_INFORMATION
  FilePipeRemoteInformation,       // FILE_PIPE_REMOTE_INFORMATION
  FileMailslotQueryInformation,    // FILE_MAILSLOT_QUERY_INFORMATION
  FileMailslotSetInformation,      // FILE_MAILSLOT_SET_INFORMATION
  FileCompressionInformation,      // FILE_COMPRESSION_INFORMATION
  FileObjectIdInformation,         // FILE_OBJECTID_INFORMATION
  FileCompletionInformation,       // FILE_COMPLETION_INFORMATION // 30
  FileMoveClusterInformation,      // FILE_MOVE_CLUSTER_INFORMATION
  FileQuotaInformation,            // FILE_QUOTA_INFORMATION
  FileReparsePointInformation,     // FILE_REPARSE_POINT_INFORMATION
  FileNetworkOpenInformation,      // FILE_NETWORK_OPEN_INFORMATION
  FileAttributeTagInformation,     // FILE_ATTRIBUTE_TAG_INFORMATION
  FileTrackingInformation,         // FILE_TRACKING_INFORMATION
  FileIdBothDirectoryInformation,  // FILE_ID_BOTH_DIR_INFORMATION
  FileIdFullDirectoryInformation,  // FILE_ID_FULL_DIR_INFORMATION
  FileValidDataLengthInformation,  // FILE_VALID_DATA_LENGTH_INFORMATION
  FileShortNameInformation,        // FILE_NAME_INFORMATION // 40
  FileIoCompletionNotificationInformation,  // FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
                                            // // since VISTA
  FileIoStatusBlockRangeInformation,   // FILE_IOSTATUSBLOCK_RANGE_INFORMATION
  FileIoPriorityHintInformation,       // FILE_IO_PRIORITY_HINT_INFORMATION
  FileSfioReserveInformation,          // FILE_SFIO_RESERVE_INFORMATION
  FileSfioVolumeInformation,           // FILE_SFIO_VOLUME_INFORMATION
  FileHardLinkInformation,             // FILE_LINKS_INFORMATION
  FileProcessIdsUsingFileInformation,  // FILE_PROCESS_IDS_USING_FILE_INFORMATION
  FileNormalizedNameInformation,       // FILE_NAME_INFORMATION
  FileNetworkPhysicalNameInformation,  // FILE_NETWORK_PHYSICAL_NAME_INFORMATION
  FileIdGlobalTxDirectoryInformation,  // FILE_ID_GLOBAL_TX_DIR_INFORMATION //
                                       // since WIN7 // 50
  FileIsRemoteDeviceInformation,       // FILE_IS_REMOTE_DEVICE_INFORMATION
  FileUnusedInformation,
  FileNumaNodeInformation,                 // FILE_NUMA_NODE_INFORMATION
  FileStandardLinkInformation,             // FILE_STANDARD_LINK_INFORMATION
  FileRemoteProtocolInformation,           // FILE_REMOTE_PROTOCOL_INFORMATION
  FileRenameInformationBypassAccessCheck,  // (kernel-mode only);
                                           // FILE_RENAME_INFORMATION // since
                                           // WIN8
  FileLinkInformationBypassAccessCheck,    // (kernel-mode only);
                                           // FILE_LINK_INFORMATION
  FileVolumeNameInformation,               // FILE_VOLUME_NAME_INFORMATION
  FileIdInformation,                       // FILE_ID_INFORMATION
  FileIdExtdDirectoryInformation,          // FILE_ID_EXTD_DIR_INFORMATION
  FileReplaceCompletionInformation,    // FILE_COMPLETION_INFORMATION // since
                                       // WINBLUE
  FileHardLinkFullIdInformation,       // FILE_LINK_ENTRY_FULL_ID_INFORMATION
  FileIdExtdBothDirectoryInformation,  // FILE_ID_EXTD_BOTH_DIR_INFORMATION //
                                       // since THRESHOLD
  FileDispositionInformationEx,  // FILE_DISPOSITION_INFO_EX // since REDSTONE
  FileRenameInformationEx,
  FileRenameInformationExBypassAccessCheck,
  FileDesiredStorageClassInformation,  // FILE_DESIRED_STORAGE_CLASS_INFORMATION
                                       // // since REDSTONE2
  FileStatInformation,                 // FILE_STAT_INFORMATION
  FileMaximumInformation
} FILE_INFORMATION_CLASS,
    *PFILE_INFORMATION_CLASS;

typedef struct _SYSTEM_BASIC_INFORMATION {
  ULONG Reserved;
  ULONG TimerResolution;
  ULONG PageSize;
  ULONG NumberOfPhysicalPages;
  ULONG LowestPhysicalPageNumber;
  ULONG HighestPhysicalPageNumber;
  ULONG AllocationGranularity;
  ULONG_PTR MinimumUserModeAddress;
  ULONG_PTR MaximumUserModeAddress;
  ULONG_PTR ActiveProcessorsAffinityMask;
  CCHAR NumberOfProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

typedef struct _FILE_PIPE_PEEK_BUFFER {
  ULONG NamedPipeState;
  ULONG ReadDataAvailable;
  ULONG NumberOfMessages;
  ULONG MessageLength;
  CHAR Data[1];
} FILE_PIPE_PEEK_BUFFER, *PFILE_PIPE_PEEK_BUFFER;

typedef struct _NAMED_PIPE_CREATE_PARAMETERS {
  ULONG NamedPipeType;
  ULONG ReadMode;
  ULONG CompletionMode;
  ULONG MaximumInstances;
  ULONG InboundQuota;
  ULONG OutboundQuota;
  LARGE_INTEGER DefaultTimeout;
  BOOLEAN TimeoutSpecified;
} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;

typedef struct _FILE_NETWORK_OPEN_INFORMATION {
  LARGE_INTEGER CreationTime;
  LARGE_INTEGER LastAccessTime;
  LARGE_INTEGER LastWriteTime;
  LARGE_INTEGER ChangeTime;
  LARGE_INTEGER AllocationSize;
  LARGE_INTEGER EndOfFile;
  ULONG FileAttributes;
} FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION;

typedef struct _SYSTEM_TIMEOFDAY_INFORMATION {
  LARGE_INTEGER BootTime;
  LARGE_INTEGER CurrentTime;
  LARGE_INTEGER TimeZoneBias;
  ULONG TimeZoneId;
  ULONG Reserved;
  ULONGLONG BootTimeBias;
  ULONGLONG SleepTimeBias;
} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;

typedef struct _SYSTEM_CONSOLE_INFORMATION {
  ULONG DriverLoaded : 1;
  ULONG Spare : 31;
} SYSTEM_CONSOLE_INFORMATION, *PSYSTEM_CONSOLE_INFORMATION;

typedef struct _KSYSTEM_TIME {
  ULONG LowPart;
  LONG High1Time;
  LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;

typedef struct _PROCESS_ACCESS_TOKEN {
  HANDLE Token;   // Needs TOKEN_ASSIGN_PRIMARY access
  HANDLE Thread;  // Handle to initial/only thread; needs
                  // THREAD_QUERY_INFORMATION access
} PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN;

#ifdef __cplusplus
typedef enum _PS_PROTECTED_TYPE : UCHAR {
  PsProtectedTypeNone,
  PsProtectedTypeProtectedLight,
  PsProtectedTypeProtected,
  PsProtectedTypeMax
} PS_PROTECTED_TYPE;
#else
typedef UCHAR PS_PROTECTED_TYPE;
#endif

#ifdef __cplusplus
typedef enum _PS_PROTECTED_SIGNER : UCHAR {
  PsProtectedSignerNone,
  PsProtectedSignerAuthenticode,
  PsProtectedSignerCodeGen,
  PsProtectedSignerAntimalware,
  PsProtectedSignerLsa,
  PsProtectedSignerWindows,
  PsProtectedSignerWinTcb,
  PsProtectedSignerWinSystem,
  PsProtectedSignerApp,
  PsProtectedSignerMax
} PS_PROTECTED_SIGNER;
#else
typedef UCHAR PS_PROTECTED_SIGNER;
#endif

typedef struct _PS_PROTECTION {
  union {
    struct {
      PS_PROTECTED_TYPE Type : 3;
      BOOLEAN Audit : 1;
      PS_PROTECTED_SIGNER Signer : 4;
    } s;
    UCHAR Level;
  };
} PS_PROTECTION, *PPS_PROTECTION;

#define RTL_CREATE_ENVIRONMENT_TRANSLATE \
  0x1  // Translate from multi-byte to Unicode
#define RTL_CREATE_ENVIRONMENT_TRANSLATE_FROM_OEM \
  0x2  // Translate from OEM to Unicode (Translate flag must also be set)
#define RTL_CREATE_ENVIRONMENT_EMPTY 0x4  // Create empty environment block

typedef struct _RTL_BUFFER {
  PUCHAR Buffer;
  PUCHAR StaticBuffer;
  SIZE_T Size;
  SIZE_T StaticSize;
  SIZE_T ReservedForAllocatedSize;  // for future doubling
  PVOID ReservedForIMalloc;         // for future pluggable growth
} RTL_BUFFER, *PRTL_BUFFER;

typedef struct _RTL_UNICODE_STRING_BUFFER {
  UNICODE_STRING String;
  RTL_BUFFER ByteBuffer;
  UCHAR MinimumStaticBufferForTerminalNul[sizeof(WCHAR)];
} RTL_UNICODE_STRING_BUFFER, *PRTL_UNICODE_STRING_BUFFER;

typedef struct _RTL_USER_PROCESS_PARAMETERS {
  ULONG MaximumLength;
  ULONG Length;

  ULONG Flags;
  ULONG DebugFlags;

  HANDLE ConsoleHandle;
  ULONG ConsoleFlags;
  HANDLE StandardInput;
  HANDLE StandardOutput;
  HANDLE StandardError;

  CURDIR CurrentDirectory;
  UNICODE_STRING DllPath;
  UNICODE_STRING ImagePathName;
  UNICODE_STRING CommandLine;
  PWCHAR Environment;

  ULONG StartingX;
  ULONG StartingY;
  ULONG CountX;
  ULONG CountY;
  ULONG CountCharsX;
  ULONG CountCharsY;
  ULONG FillAttribute;

  ULONG WindowFlags;
  ULONG ShowWindowFlags;
  UNICODE_STRING WindowTitle;
  UNICODE_STRING DesktopInfo;
  UNICODE_STRING ShellInfo;
  UNICODE_STRING RuntimeData;
  RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];

  ULONG_PTR EnvironmentSize;
  ULONG_PTR EnvironmentVersion;
  PVOID PackageDependencyData;
  ULONG ProcessGroupId;
  ULONG LoaderThreads;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

#define RTL_USER_PROCESS_PARAMETERS_NORMALIZED 0x01
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER 0x02
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_KERNEL 0x04
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_SERVER 0x08
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB 0x20
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_16MB 0x40
#define RTL_USER_PROCESS_PARAMETERS_CASE_SENSITIVE 0x80
#define RTL_USER_PROCESS_PARAMETERS_DISABLE_HEAP_DECOMMIT 0x100
#define RTL_USER_PROCESS_PARAMETERS_DLL_REDIRECTION_LOCAL 0x1000
#define RTL_USER_PROCESS_PARAMETERS_APP_MANIFEST_PRESENT 0x2000
#define RTL_USER_PROCESS_PARAMETERS_IMAGE_KEY_MISSING 0x4000
#define RTL_USER_PROCESS_PARAMETERS_NX_OPTIN 0x20000

typedef struct _RTL_USER_PROCESS_INFORMATION {
  ULONG Length;
  HANDLE Process;
  HANDLE Thread;
  CLIENT_ID ClientId;
  SECTION_IMAGE_INFORMATION ImageInformation;
} RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION;

// Handle tag bits for PEB stdio file handles
#define PEB_STDIO_HANDLE_NATIVE 0
#define PEB_STDIO_HANDLE_SUBSYS 1
#define PEB_STDIO_HANDLE_PM 2
#define PEB_STDIO_HANDLE_RESERVED 3

#define GDI_HANDLE_BUFFER_SIZE32 34
#define GDI_HANDLE_BUFFER_SIZE64 60

#ifndef _WIN64
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
#else
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64
#endif

typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32];
typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64];
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];

#define FLS_MAXIMUM_AVAILABLE 128
#define TLS_MINIMUM_AVAILABLE 64
#define TLS_EXPANSION_SLOTS 1024

typedef struct _PEB_LDR_DATA {
  ULONG Length;
  BOOLEAN Initialized;
  HANDLE SsHandle;
  LIST_ENTRY InLoadOrderModuleList;
  LIST_ENTRY InMemoryOrderModuleList;
  LIST_ENTRY InInitializationOrderModuleList;
  PVOID EntryInProgress;
  BOOLEAN ShutdownInProgress;
  HANDLE ShutdownThreadId;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _ACTIVATION_CONTEXT_STACK {
  struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* ActiveFrame;
  LIST_ENTRY FrameListCache;
  ULONG Flags;
  ULONG NextCookieSequenceNumber;
  ULONG StackId;
} ACTIVATION_CONTEXT_STACK, *PACTIVATION_CONTEXT_STACK;

typedef struct _PEB {
  BOOLEAN InheritedAddressSpace;
  BOOLEAN ReadImageFileExecOptions;
  BOOLEAN BeingDebugged;
  union {
    BOOLEAN BitField;
    struct {
      BOOLEAN ImageUsesLargePages : 1;
      BOOLEAN IsProtectedProcess : 1;
      BOOLEAN IsImageDynamicallyRelocated : 1;
      BOOLEAN SkipPatchingUser32Forwarders : 1;
      BOOLEAN IsPackagedProcess : 1;
      BOOLEAN IsAppContainer : 1;
      BOOLEAN IsProtectedProcessLight : 1;
      BOOLEAN IsLongPathAwareProcess : 1;
    } s1;
  } u1;

  HANDLE Mutant;

  PVOID ImageBaseAddress;
  PPEB_LDR_DATA Ldr;
  PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
  PVOID SubSystemData;
  PVOID ProcessHeap;
  PRTL_CRITICAL_SECTION FastPebLock;
  PVOID AtlThunkSListPtr;
  PVOID IFEOKey;
  union {
    ULONG CrossProcessFlags;
    struct {
      ULONG ProcessInJob : 1;
      ULONG ProcessInitializing : 1;
      ULONG ProcessUsingVEH : 1;
      ULONG ProcessUsingVCH : 1;
      ULONG ProcessUsingFTH : 1;
      ULONG ProcessPreviouslyThrottled : 1;
      ULONG ProcessCurrentlyThrottled : 1;
      ULONG ReservedBits0 : 25;
    } s2;
  } u2;
  union {
    PVOID KernelCallbackTable;
    PVOID UserSharedInfoPtr;
  } u3;
  ULONG SystemReserved[1];
  ULONG AtlThunkSListPtr32;
  PVOID ApiSetMap;
  ULONG TlsExpansionCounter;
  PVOID TlsBitmap;
  ULONG TlsBitmapBits[2];

  PVOID ReadOnlySharedMemoryBase;
  PVOID SharedData;  // HotpatchInformation
  PVOID* ReadOnlyStaticServerData;

  PVOID AnsiCodePageData;      // PCPTABLEINFO
  PVOID OemCodePageData;       // PCPTABLEINFO
  PVOID UnicodeCaseTableData;  // PNLSTABLEINFO

  ULONG NumberOfProcessors;
  ULONG NtGlobalFlag;

  LARGE_INTEGER CriticalSectionTimeout;
  SIZE_T HeapSegmentReserve;
  SIZE_T HeapSegmentCommit;
  SIZE_T HeapDeCommitTotalFreeThreshold;
  SIZE_T HeapDeCommitFreeBlockThreshold;

  ULONG NumberOfHeaps;
  ULONG MaximumNumberOfHeaps;
  PVOID* ProcessHeaps;  // PHEAP

  PVOID GdiSharedHandleTable;
  PVOID ProcessStarterHelper;
  ULONG GdiDCAttributeList;

  PRTL_CRITICAL_SECTION LoaderLock;

  ULONG OSMajorVersion;
  ULONG OSMinorVersion;
  USHORT OSBuildNumber;
  USHORT OSCSDVersion;
  ULONG OSPlatformId;
  ULONG ImageSubsystem;
  ULONG ImageSubsystemMajorVersion;
  ULONG ImageSubsystemMinorVersion;
  ULONG_PTR ActiveProcessAffinityMask;
  GDI_HANDLE_BUFFER GdiHandleBuffer;
  PVOID PostProcessInitRoutine;

  PVOID TlsExpansionBitmap;
  ULONG TlsExpansionBitmapBits[32];

  ULONG SessionId;

  ULARGE_INTEGER AppCompatFlags;
  ULARGE_INTEGER AppCompatFlagsUser;
  PVOID pShimData;
  PVOID AppCompatInfo;  // APPCOMPAT_EXE_DATA

  UNICODE_STRING CSDVersion;

  PVOID ActivationContextData;               // ACTIVATION_CONTEXT_DATA
  PVOID ProcessAssemblyStorageMap;           // ASSEMBLY_STORAGE_MAP
  PVOID SystemDefaultActivationContextData;  // ACTIVATION_CONTEXT_DATA
  PVOID SystemAssemblyStorageMap;            // ASSEMBLY_STORAGE_MAP

  SIZE_T MinimumStackCommit;

  PVOID* FlsCallback;
  LIST_ENTRY FlsListHead;
  PVOID FlsBitmap;
  ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
  ULONG FlsHighIndex;

  PVOID WerRegistrationData;
  PVOID WerShipAssertPtr;
  PVOID pUnused;  // pContextData
  PVOID pImageHeaderHash;
  union {
    ULONG TracingFlags;
    struct {
      ULONG HeapTracingEnabled : 1;
      ULONG CritSecTracingEnabled : 1;
      ULONG LibLoaderTracingEnabled : 1;
      ULONG SpareTracingBits : 29;
    } s3;
  } u4;
  ULONGLONG CsrServerReadOnlySharedMemoryBase;
  PVOID TppWorkerpListLock;
  LIST_ENTRY TppWorkerpList;
  PVOID WaitOnAddressHashTable[128];
  PVOID TelemetryCoverageHeader;  // REDSTONE3
  ULONG CloudFileFlags;
} PEB, *PPEB;

#define GDI_BATCH_BUFFER_SIZE 310

typedef struct _GDI_TEB_BATCH {
  ULONG Offset;
  ULONG_PTR HDC;
  ULONG Buffer[GDI_BATCH_BUFFER_SIZE];
} GDI_TEB_BATCH, *PGDI_TEB_BATCH;

typedef struct _TEB_ACTIVE_FRAME_CONTEXT {
  ULONG Flags;
  PSTR FrameName;
} TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT;

typedef struct _TEB_ACTIVE_FRAME {
  ULONG Flags;
  struct _TEB_ACTIVE_FRAME* Previous;
  PTEB_ACTIVE_FRAME_CONTEXT Context;
} TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME;

typedef struct _TEB {
  NT_TIB NtTib;

  PVOID EnvironmentPointer;
  CLIENT_ID ClientId;
  PVOID ActiveRpcHandle;
  PVOID ThreadLocalStoragePointer;
  PPEB ProcessEnvironmentBlock;

  ULONG LastErrorValue;
  ULONG CountOfOwnedCriticalSections;
  PVOID CsrClientThread;
  PVOID Win32ThreadInfo;
  ULONG User32Reserved[26];
  ULONG UserReserved[5];
  PVOID WOW32Reserved;
  LCID CurrentLocale;
  ULONG FpSoftwareStatusRegister;
  PVOID ReservedForDebuggerInstrumentation[16];
#ifdef _WIN64
  PVOID SystemReserved1[30];
#else
  PVOID SystemReserved1[26];
#endif
  CHAR PlaceholderCompatibilityMode;
  CHAR PlaceholderReserved[11];
  ULONG ProxiedProcessId;
  ACTIVATION_CONTEXT_STACK ActivationStack;

  UCHAR WorkingOnBehalfTicket[8];
  NTSTATUS ExceptionCode;

  PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
  ULONG_PTR InstrumentationCallbackSp;
  ULONG_PTR InstrumentationCallbackPreviousPc;
  ULONG_PTR InstrumentationCallbackPreviousSp;
#ifdef _WIN64
  ULONG TxFsContext;
#endif
  BOOLEAN InstrumentationCallbackDisabled;
#ifndef _WIN64
  UCHAR SpareBytes[23];
  ULONG TxFsContext;
#endif
  GDI_TEB_BATCH GdiTebBatch;
  CLIENT_ID RealClientId;
  HANDLE GdiCachedProcessHandle;
  ULONG GdiClientPID;
  ULONG GdiClientTID;
  PVOID GdiThreadLocalInfo;
  ULONG_PTR Win32ClientInfo[62];
  PVOID glDispatchTable[233];
  ULONG_PTR glReserved1[29];
  PVOID glReserved2;
  PVOID glSectionInfo;
  PVOID glSection;
  PVOID glTable;
  PVOID glCurrentRC;
  PVOID glContext;

  NTSTATUS LastStatusValue;
  UNICODE_STRING StaticUnicodeString;
  WCHAR StaticUnicodeBuffer[261];

  PVOID DeallocationStack;
  PVOID TlsSlots[64];
  LIST_ENTRY TlsLinks;

  PVOID Vdm;
  PVOID ReservedForNtRpc;
  PVOID DbgSsReserved[2];

  ULONG HardErrorMode;
#ifdef _WIN64
  PVOID Instrumentation[11];
#else
  PVOID Instrumentation[9];
#endif
  GUID ActivityId;

  PVOID SubProcessTag;
  PVOID PerflibData;
  PVOID EtwTraceData;
  PVOID WinSockData;
  ULONG GdiBatchCount;

  union {
    PROCESSOR_NUMBER CurrentIdealProcessor;
    ULONG IdealProcessorValue;
    struct {
      UCHAR ReservedPad0;
      UCHAR ReservedPad1;
      UCHAR ReservedPad2;
      UCHAR IdealProcessor;
    } s1;
  } u1;

  ULONG GuaranteedStackBytes;
  PVOID ReservedForPerf;
  PVOID ReservedForOle;
  ULONG WaitingOnLoaderLock;
  PVOID SavedPriorityState;
  ULONG_PTR ReservedForCodeCoverage;
  PVOID ThreadPoolData;
  PVOID* TlsExpansionSlots;
#ifdef _WIN64
  PVOID DeallocationBStore;
  PVOID BStoreLimit;
#endif
  ULONG MuiGeneration;
  ULONG IsImpersonating;
  PVOID NlsCache;
  PVOID pShimData;
  USHORT HeapVirtualAffinity;
  USHORT LowFragHeapDataSlot;
  HANDLE CurrentTransactionHandle;
  PTEB_ACTIVE_FRAME ActiveFrame;
  PVOID FlsData;

  PVOID PreferredLanguages;
  PVOID UserPrefLanguages;
  PVOID MergedPrefLanguages;
  ULONG MuiImpersonation;

  union {
    USHORT CrossTebFlags;
    USHORT SpareCrossTebBits : 16;
  } u2;
  union {
    USHORT SameTebFlags;
    struct {
      USHORT SafeThunkCall : 1;
      USHORT InDebugPrint : 1;
      USHORT HasFiberData : 1;
      USHORT SkipThreadAttach : 1;
      USHORT WerInShipAssertCode : 1;
      USHORT RanProcessInit : 1;
      USHORT ClonedThread : 1;
      USHORT SuppressDebugMsg : 1;
      USHORT DisableUserStackWalk : 1;
      USHORT RtlExceptionAttached : 1;
      USHORT InitialThread : 1;
      USHORT SessionAware : 1;
      USHORT LoadOwner : 1;
      USHORT LoaderWorker : 1;
      USHORT SkipLoaderInit : 1;
      USHORT SpareSameTebBits : 1;
    } s2;
  } u3;

  PVOID TxnScopeEnterCallback;
  PVOID TxnScopeExitCallback;
  PVOID TxnScopeContext;
  ULONG LockCount;
  LONG WowTebOffset;
  PVOID ResourceRetValue;
  PVOID ReservedForWdf;
  ULONGLONG ReservedForCrt;
  GUID EffectiveContainerId;
} TEB, *PTEB;

typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE {
  StandardDesign,
  NEC98x86,
  EndAlternatives
} ALTERNATIVE_ARCHITECTURE_TYPE;

#define PROCESSOR_FEATURE_MAX 64

#define MAX_WOW64_SHARED_ENTRIES 16

#define NX_SUPPORT_POLICY_ALWAYSOFF 0
#define NX_SUPPORT_POLICY_ALWAYSON 1
#define NX_SUPPORT_POLICY_OPTIN 2
#define NX_SUPPORT_POLICY_OPTOUT 3

#pragma pack(push, 4)
typedef struct _KUSER_SHARED_DATA {
  ULONG TickCountLowDeprecated;
  ULONG TickCountMultiplier;

  volatile KSYSTEM_TIME InterruptTime;
  volatile KSYSTEM_TIME SystemTime;
  volatile KSYSTEM_TIME TimeZoneBias;

  USHORT ImageNumberLow;
  USHORT ImageNumberHigh;

  WCHAR NtSystemRoot[260];

  ULONG MaxStackTraceDepth;

  ULONG CryptoExponent;

  ULONG TimeZoneId;
  ULONG LargePageMinimum;
  ULONG AitSamplingValue;
  ULONG AppCompatFlag;
  ULONGLONG RNGSeedVersion;
  ULONG GlobalValidationRunlevel;
  LONG TimeZoneBiasStamp;

  ULONG NtBuildNumber;
  ULONG NtProductType;
  BOOLEAN ProductTypeIsValid;
  UCHAR Reserved0[1];
  USHORT NativeProcessorArchitecture;

  ULONG NtMajorVersion;
  ULONG NtMinorVersion;

  BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];

  ULONG Reserved1;
  ULONG Reserved3;

  volatile ULONG TimeSlip;

  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
  ULONG BootId;

  LARGE_INTEGER SystemExpirationDate;

  ULONG SuiteMask;

  BOOLEAN KdDebuggerEnabled;
  union {
    UCHAR MitigationPolicies;
    struct {
      UCHAR NXSupportPolicy : 2;
      UCHAR SEHValidationPolicy : 2;
      UCHAR CurDirDevicesSkippedForDlls : 2;
      UCHAR Reserved : 2;
    } s1;
  } u1;
  UCHAR Reserved6[2];

  volatile ULONG ActiveConsoleId;

  volatile ULONG DismountCount;

  ULONG ComPlusPackage;

  ULONG LastSystemRITEventTickCount;

  ULONG NumberOfPhysicalPages;

  BOOLEAN SafeBootMode;
  UCHAR VirtualizationFlags;
  UCHAR Reserved12[2];

  union {
    ULONG SharedDataFlags;
    struct {
      ULONG DbgErrorPortPresent : 1;
      ULONG DbgElevationEnabled : 1;
      ULONG DbgVirtEnabled : 1;
      ULONG DbgInstallerDetectEnabled : 1;
      ULONG DbgLkgEnabled : 1;
      ULONG DbgDynProcessorEnabled : 1;
      ULONG DbgConsoleBrokerEnabled : 1;
      ULONG DbgSecureBootEnabled : 1;
      ULONG DbgMultiSessionSku : 1;
      ULONG DbgMultiUsersInSessionSku : 1;
      ULONG SpareBits : 22;
    } s2;
  } u2;
  ULONG DataFlagsPad[1];

  ULONGLONG TestRetInstruction;
  LONGLONG QpcFrequency;
  ULONG SystemCall;
  ULONG SystemCallPad0;
  ULONGLONG SystemCallPad[2];

  union {
    volatile KSYSTEM_TIME TickCount;
    volatile ULONG64 TickCountQuad;
    ULONG ReservedTickCountOverlay[3];
  };
  ULONG TickCountPad[1];

  ULONG Cookie;
  ULONG CookiePad[1];

  LONGLONG ConsoleSessionForegroundProcessId;
  ULONGLONG TimeUpdateLock;
  ULONGLONG BaselineSystemTimeQpc;
  ULONGLONG BaselineInterruptTimeQpc;
  ULONGLONG QpcSystemTimeIncrement;
  ULONGLONG QpcInterruptTimeIncrement;
  UCHAR QpcSystemTimeIncrementShift;
  UCHAR QpcInterruptTimeIncrementShift;

  USHORT UnparkedProcessorCount;
  ULONG EnclaveFeatureMask[4];
  ULONG Reserved8;
  USHORT UserModeGlobalLogger[16];
  ULONG ImageFileExecutionOptions;

  ULONG LangGenerationCount;
  ULONGLONG Reserved4;
  volatile ULONG64 InterruptTimeBias;
  volatile ULONG64 QpcBias;

  ULONG ActiveProcessorCount;
  volatile UCHAR ActiveGroupCount;
  UCHAR Reserved9;
  union {
    USHORT QpcData;
    struct {
      UCHAR QpcBypassEnabled : 1;
      UCHAR QpcShift : 1;
    } s3;
  } u3;

  LARGE_INTEGER TimeZoneBiasEffectiveStart;
  LARGE_INTEGER TimeZoneBiasEffectiveEnd;
  XSTATE_CONFIGURATION XState;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
#pragma pack(pop)

#ifdef __cplusplus
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x20,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x2c,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x2e,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved1) == 0x2b4,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved3) == 0x2b8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dc,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) ==
                  0x2e4,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x310,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320,
              "Offset check");
static_assert(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3d8, "Offset check");
#endif

#if !defined(_KERNEL_MODE) && !defined(KERNELMODE)
#define USER_SHARED_DATA 0x7FFE0000
#define SharedUserData ((KUSER_SHARED_DATA* const)USER_SHARED_DATA)
#else
#if defined(_M_IX86)
#define KI_USER_SHARED_DATA 0xFFDF0000
#elif defined(_M_AMD64)
#define KI_USER_SHARED_DATA 0xFFFFF78000000000Ui64
#elif defined(_M_ARM)
#define KI_USER_SHARED_DATA 0xFFFF9000
#elif defined(M_ARM64)
#define KI_USER_SHARED_DATA 0xFFFFF78000000000Ui64
#endif
#define SharedUserData ((KUSER_SHARED_DATA* const)KI_USER_SHARED_DATA)
#endif

typedef struct _PROCESS_BASIC_INFORMATION {
  NTSTATUS ExitStatus;
  PPEB PebBaseAddress;
  ULONG_PTR AffinityMask;
  KPRIORITY BasePriority;
  HANDLE UniqueProcessId;
  HANDLE InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;

typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION {
  SIZE_T Size;  // Set to sizeof structure on input
  PROCESS_BASIC_INFORMATION BasicInfo;
  union {
    ULONG Flags;
    struct {
      ULONG IsProtectedProcess : 1;
      ULONG IsWow64Process : 1;
      ULONG IsProcessDeleting : 1;
      ULONG IsCrossSessionCreate : 1;
      ULONG IsFrozen : 1;
      ULONG IsBackground : 1;
      ULONG IsStronglyNamed : 1;
      ULONG IsSecureProcess : 1;
      ULONG IsSubsystemProcess : 1;
      ULONG SpareBits : 23;
    } s;
  } u;
} PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION;

typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION {
  SYSTEM_THREAD_INFORMATION ThreadInfo;
  PVOID StackBase;
  PVOID StackLimit;
  PVOID Win32StartAddress;
  PTEB TebBase;  // Since Vista
  ULONG_PTR Reserved2;
  ULONG_PTR Reserved3;
  ULONG_PTR Reserved4;
} SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;

#ifndef FIELD_OFFSET
#if !defined(__clang__)
#define FIELD_OFFSET(type, field) ((LONG)(LONG_PTR) & (((type*)0)->field))
#else
#define FIELD_OFFSET(type, field) ((LONG) __builtin_offsetof(type, field))
#endif
#endif
#ifndef UFIELD_OFFSET
#if !defined(__clang__)
#define UFIELD_OFFSET(type, field) ((ULONG)(LONG_PTR) & (((type*)0)->field))
#else
#define UFIELD_OFFSET(type, field) ((ULONG) __builtin_offsetof(type, field))
#endif
#endif

#define PTR_ADD_OFFSET(Pointer, Offset) \
  ((PVOID)((ULONG_PTR)(Pointer) + (ULONG_PTR)(Offset)))
#define PTR_SUB_OFFSET(Pointer, Offset) \
  ((PVOID)((ULONG_PTR)(Pointer) - (ULONG_PTR)(Offset)))
#define ALIGN_DOWN_BY(Address, Align) ((ULONG_PTR)(Address) & ~(Align - 1))
#define ALIGN_DOWN_POINTER_BY(Pointer, Align) \
  ((PVOID)ALIGN_DOWN_BY(Pointer, Align))
#define ALIGN_DOWN_POINTER(Pointer, Type) ((PVOID)ALIGN_DOWN(Pointer, Type))
#define ALIGN_UP_BY(Address, Align) \
  (((ULONG_PTR)(Address) + (Align)-1) & ~((Align)-1))
#define ALIGN_UP_POINTER_BY(Pointer, Align) ((PVOID)ALIGN_UP_BY(Pointer, Align))
#define ALIGN_UP_POINTER(Pointer, Type) ((PVOID)ALIGN_UP(Pointer, Type))

#define InitializeObjectAttributes(p, n, a, r, s) \
  {                                               \
    (p)->Length = sizeof(OBJECT_ATTRIBUTES);      \
    (p)->RootDirectory = r;                       \
    (p)->Attributes = a;                          \
    (p)->ObjectName = n;                          \
    (p)->SecurityDescriptor = s;                  \
    (p)->SecurityQualityOfService = NULL;         \
  }

#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_FORCE_ACCESS_CHECK 0x00000400L
#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800
#define OBJ_DONT_REPARSE 0x00001000
#define OBJ_VALID_ATTRIBUTES 0x00001FF2

#if NTDDI_VERSION >= NTDDI_VISTA
#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFFF)
#else
#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3FF)
#endif

#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001
#define THREAD_CREATE_FLAGS_SUPPRESS_DLLMAINS 0x00000002
#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
#define THREAD_CREATE_FLAGS_HAS_SECURITY_DESCRIPTOR 0x00000010  // ?
#define THREAD_CREATE_FLAGS_ACCESS_CHECK_IN_TARGET 0x00000020  // ?
#define THREAD_CREATE_FLAGS_INITIAL_THREAD 0x00000080

#define DEBUG_READ_EVENT 0x0001
#define DEBUG_PROCESS_ASSIGN 0x0002
#define DEBUG_SET_INFORMATION 0x0004
#define DEBUG_QUERY_INFORMATION 0x0008

#define DEBUG_ALL_ACCESS                                       \
  (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | DEBUG_READ_EVENT | \
   DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | DEBUG_QUERY_INFORMATION)

#define DEBUG_KILL_ON_CLOSE 0x1

#ifndef IO_COMPLETION_QUERY_STATE
#define IO_COMPLETION_QUERY_STATE 0x0001
#endif
#ifndef IO_COMPLETION_MODIFY_STATE
#define IO_COMPLETION_MODIFY_STATE 0x0002
#endif
#ifndef IO_COMPLETION_ALL_ACCESS
#define IO_COMPLETION_ALL_ACCESS                                        \
  (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | IO_COMPLETION_QUERY_STATE | \
   IO_COMPLETION_MODIFY_STATE)
#endif

#ifndef SEMAPHORE_ALL_ACCESS
#define SEMAPHORE_QUERY_STATE 0x0001
#define SEMAPHORE_MODIFY_STATE 0x0002

#define SEMAPHORE_ALL_ACCESS                                        \
  (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | SEMAPHORE_QUERY_STATE | \
   SEMAPHORE_MODIFY_STATE)
#endif

#ifndef MUTANT_ALL_ACCESS
#define MUTANT_QUERY_STATE 0x0001

#define MUTANT_ALL_ACCESS \
  (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | MUTANT_QUERY_STATE)
#endif

#ifndef EVENT_ALL_ACCESS
#define EVENT_QUERY_STATE 0x0001
#define EVENT_MODIFY_STATE 0x0002

#define EVENT_ALL_ACCESS                                        \
  (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | EVENT_QUERY_STATE | \
   EVENT_MODIFY_STATE)
#endif

#define KEYEDEVENT_WAIT 0x0001
#define KEYEDEVENT_WAKE 0x0002
#define KEYEDEVENT_ALL_ACCESS \
  (STANDARD_RIGHTS_REQUIRED | KEYEDEVENT_WAIT | KEYEDEVENT_WAKE)

#define DIRECTORY_QUERY 0x0001
#define DIRECTORY_TRAVERSE 0x0002
#define DIRECTORY_CREATE_OBJECT 0x0004
#define DIRECTORY_CREATE_SUBDIRECTORY 0x0008

#define DIRECTORY_ALL_ACCESS                                         \
  (STANDARD_RIGHTS_REQUIRED | DIRECTORY_QUERY | DIRECTORY_TRAVERSE | \
   DIRECTORY_CREATE_OBJECT | DIRECTORY_CREATE_SUBDIRECTORY)

#define SYMBOLIC_LINK_QUERY 0x0001

#define SYMBOLIC_LINK_ALL_ACCESS \
  (STANDARD_RIGHTS_REQUIRED | SYMBOLIC_LINK_QUERY)

#ifndef TOKEN_ALL_ACCESS
#define TOKEN_ASSIGN_PRIMARY 0x0001
#define TOKEN_DUPLICATE 0x0002
#define TOKEN_IMPERSONATE 0x0004
#define TOKEN_QUERY 0x0008
#define TOKEN_QUERY_SOURCE 0x0010
#define TOKEN_ADJUST_PRIVILEGES 0x0020
#define TOKEN_ADJUST_GROUPS 0x0040
#define TOKEN_ADJUST_DEFAULT 0x0080
#define TOKEN_ADJUST_SESSIONID 0x0100

#define TOKEN_ALL_ACCESS_P                                             \
  (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | \
   TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |              \
   TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT)

#define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P | TOKEN_ADJUST_SESSIONID)
#endif

#define WORKER_FACTORY_RELEASE_WORKER 0x0001
#define WORKER_FACTORY_WAIT 0x0002
#define WORKER_FACTORY_SET_INFORMATION 0x0004
#define WORKER_FACTORY_QUERY_INFORMATION 0x0008
#define WORKER_FACTORY_READY_WORKER 0x0010
#define WORKER_FACTORY_SHUTDOWN 0x0020

#define WORKER_FACTORY_ALL_ACCESS                                   \
  (STANDARD_RIGHTS_REQUIRED | WORKER_FACTORY_RELEASE_WORKER |       \
   WORKER_FACTORY_WAIT | WORKER_FACTORY_SET_INFORMATION |           \
   WORKER_FACTORY_QUERY_INFORMATION | WORKER_FACTORY_READY_WORKER | \
   WORKER_FACTORY_SHUTDOWN)

#define NtCurrentProcess ((HANDLE)(LONG_PTR)-1)
#define NtCurrentThread ((HANDLE)(LONG_PTR)-2)
#define NtCurrentPeb() (NtCurrentTeb()->ProcessEnvironmentBlock)
#define NtCurrentProcessId() (NtCurrentTeb()->ClientId.UniqueProcess)
#define NtCurrentThreadId() (NtCurrentTeb()->ClientId.UniqueThread)
#define RtlProcessHeap() (NtCurrentPeb()->ProcessHeap)

typedef struct _RTL_HEAP_ENTRY {
  SIZE_T Size;
  USHORT Flags;
  USHORT AllocatorBackTraceIndex;
  union {
    struct {
      SIZE_T Settable;
      ULONG Tag;
    } s1;
    struct {
      SIZE_T CommittedSize;
      PVOID FirstBlock;
    } s2;
  } u;
} RTL_HEAP_ENTRY, *PRTL_HEAP_ENTRY;

#define RTL_HEAP_BUSY (USHORT)0x0001
#define RTL_HEAP_SEGMENT (USHORT)0x0002
#define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010
#define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020
#define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040
#define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080
#define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00e0
#define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100
#define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200

typedef struct _RTL_HEAP_TAG {
  ULONG NumberOfAllocations;
  ULONG NumberOfFrees;
  SIZE_T BytesAllocated;
  USHORT TagIndex;
  USHORT CreatorBackTraceIndex;
  WCHAR TagName[24];
} RTL_HEAP_TAG, *PRTL_HEAP_TAG;

typedef struct _RTL_HEAP_INFORMATION {
  PVOID BaseAddress;
  ULONG Flags;
  USHORT EntryOverhead;
  USHORT CreatorBackTraceIndex;
  SIZE_T BytesAllocated;
  SIZE_T BytesCommitted;
  ULONG NumberOfTags;
  ULONG NumberOfEntries;
  ULONG NumberOfPseudoTags;
  ULONG PseudoTagGranularity;
  ULONG Reserved[5];
  PRTL_HEAP_TAG Tags;
  PRTL_HEAP_ENTRY Entries;
} RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;

typedef struct _RTL_PROCESS_HEAPS {
  ULONG NumberOfHeaps;
  RTL_HEAP_INFORMATION Heaps[1];
} RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS;

typedef NTSTATUS(NTAPI* PRTL_HEAP_COMMIT_ROUTINE)(_In_ PVOID Base,
                                                  _Inout_ PVOID* CommitAddress,
                                                  _Inout_ PSIZE_T CommitSize);

typedef struct _RTL_HEAP_PARAMETERS {
  ULONG Length;
  SIZE_T SegmentReserve;
  SIZE_T SegmentCommit;
  SIZE_T DeCommitFreeBlockThreshold;
  SIZE_T DeCommitTotalFreeThreshold;
  SIZE_T MaximumAllocationSize;
  SIZE_T VirtualMemoryThreshold;
  SIZE_T InitialCommit;
  SIZE_T InitialReserve;
  PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
  SIZE_T Reserved[2];
} RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;

#define HEAP_SETTABLE_USER_VALUE 0x00000100
#define HEAP_SETTABLE_USER_FLAG1 0x00000200
#define HEAP_SETTABLE_USER_FLAG2 0x00000400
#define HEAP_SETTABLE_USER_FLAG3 0x00000800
#define HEAP_SETTABLE_USER_FLAGS 0x00000e00

#define HEAP_CLASS_0 0x00000000  // Process heap
#define HEAP_CLASS_1 0x00001000  // Private heap
#define HEAP_CLASS_2 0x00002000  // Kernel heap
#define HEAP_CLASS_3 0x00003000  // GDI heap
#define HEAP_CLASS_4 0x00004000  // User heap
#define HEAP_CLASS_5 0x00005000  // Console heap
#define HEAP_CLASS_6 0x00006000  // User desktop heap
#define HEAP_CLASS_7 0x00007000  // CSR shared heap
#define HEAP_CLASS_8 0x00008000  // CSR port heap
#define HEAP_CLASS_MASK 0x0000f000

typedef struct _RTL_HEAP_TAG_INFO {
  ULONG NumberOfAllocations;
  ULONG NumberOfFrees;
  SIZE_T BytesAllocated;
} RTL_HEAP_TAG_INFO, *PRTL_HEAP_TAG_INFO;

#define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS

typedef struct _RTL_HEAP_WALK_ENTRY {
  PVOID DataAddress;
  SIZE_T DataSize;
  UCHAR OverheadBytes;
  UCHAR SegmentIndex;
  USHORT Flags;
  union {
    struct {
      SIZE_T Settable;
      USHORT TagIndex;
      USHORT AllocatorBackTraceIndex;
      ULONG Reserved[2];
    } Block;
    struct {
      ULONG CommittedSize;
      ULONG UnCommittedSize;
      PVOID FirstEntry;
      PVOID LastEntry;
    } Segment;
  };
} RTL_HEAP_WALK_ENTRY, *PRTL_HEAP_WALK_ENTRY;

// HEAP_INFORMATION_CLASS. winnt.h is incomplete
#define HeapCompatibilityInformation 0x0  // q; s: ULONG
#define HeapEnableTerminationOnCorruption 0x1  // q; s: NULL
#define HeapExtendedInformation 0x2  // q; s: HEAP_EXTENDED_INFORMATION
#define HeapOptimizeResources 0x3  // q; s: HEAP_OPTIMIZE_RESOURCES_INFORMATION
#define HeapTaggingInformation 0x4
#define HeapStackDatabase 0x5
#define HeapDetailedFailureInformation 0x80000001
#define HeapSetDebuggingInformation \
  0x80000002  // q; s: HEAP_DEBUGGING_INFORMATION

typedef struct _PROCESS_HEAP_INFORMATION {
  ULONG_PTR ReserveSize;
  ULONG_PTR CommitSize;
  ULONG NumberOfHeaps;
  ULONG_PTR FirstHeapInformationOffset;
} PROCESS_HEAP_INFORMATION, *PPROCESS_HEAP_INFORMATION;

typedef struct _HEAP_INFORMATION {
  ULONG_PTR Address;
  ULONG Mode;
  ULONG_PTR ReserveSize;
  ULONG_PTR CommitSize;
  ULONG_PTR FirstRegionInformationOffset;
  ULONG_PTR NextHeapInformationOffset;
} HEAP_INFORMATION, *PHEAP_INFORMATION;

typedef struct _HEAP_EXTENDED_INFORMATION {
  HANDLE Process;
  ULONG_PTR Heap;
  ULONG Level;
  PVOID CallbackRoutine;
  PVOID CallbackContext;
  PROCESS_HEAP_INFORMATION ProcessHeapInformation;
  HEAP_INFORMATION HeapInformation;
} HEAP_EXTENDED_INFORMATION, *PHEAP_EXTENDED_INFORMATION;

typedef NTSTATUS(NTAPI* PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)(
    _In_ LONG Reserved, _In_ PVOID HeapHandle, _In_ PVOID BaseAddress,
    _In_ SIZE_T BlockSize, _In_ ULONG StackTraceDepth, _In_ PVOID* StackTrace);

typedef struct _HEAP_DEBUGGING_INFORMATION {
  PVOID InterceptorFunction;
  USHORT InterceptorValue;
  ULONG ExtendedOptions;
  ULONG StackTraceDepth;
  SIZE_T MinTotalBlockSize;
  SIZE_T MaxTotalBlockSize;
  PRTL_HEAP_LEAK_ENUMERATION_ROUTINE HeapLeakEnumerationRoutine;
} HEAP_DEBUGGING_INFORMATION, *PHEAP_DEBUGGING_INFORMATION;

typedef NTSTATUS(NTAPI* PRTL_ENUM_HEAPS_ROUTINE)(_In_ PVOID HeapHandle,
                                                 _In_ PVOID Parameter);

typedef NTSTATUS(NTAPI* PUSER_THREAD_START_ROUTINE)(_In_ PVOID ThreadParameter);

#define LDR_FORMAT_MESSAGE_FROM_SYSTEM_MESSAGE_TABLE 11

#define RTL_ERRORMODE_NOGPFAULTERRORBOX 0x0020
#define RTL_ERRORMODE_NOOPENFILEERRORBOX 0x0040

#define RTL_ACQUIRE_PRIVILEGE_REVERT 0x00000001
#define RTL_ACQUIRE_PRIVILEGE_PROCESS 0x00000002

typedef VOID(NTAPI* PLDR_IMPORT_MODULE_CALLBACK)(_In_ PVOID Parameter,
                                                 _In_ PSTR ModuleName);

typedef struct _LDR_IMPORT_CALLBACK_INFO {
  PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine;
  PVOID ImportCallbackParameter;
} LDR_IMPORT_CALLBACK_INFO, *PLDR_IMPORT_CALLBACK_INFO;

typedef struct _LDR_SECTION_INFO {
  HANDLE SectionHandle;
  ACCESS_MASK DesiredAccess;
  POBJECT_ATTRIBUTES ObjectAttributes;
  ULONG SectionPageProtection;
  ULONG AllocationAttributes;
} LDR_SECTION_INFO, *PLDR_SECTION_INFO;

typedef struct _LDR_VERIFY_IMAGE_INFO {
  ULONG Size;
  ULONG Flags;
  LDR_IMPORT_CALLBACK_INFO CallbackInfo;
  LDR_SECTION_INFO SectionInfo;
  USHORT ImageCharacteristics;
} LDR_VERIFY_IMAGE_INFO, *PLDR_VERIFY_IMAGE_INFO;

typedef enum _SEMAPHORE_INFORMATION_CLASS {
  SemaphoreBasicInformation
} SEMAPHORE_INFORMATION_CLASS;

typedef struct _SEMAPHORE_BASIC_INFORMATION {
  LONG CurrentCount;
  LONG MaximumCount;
} SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION;

typedef enum _TIMER_INFORMATION_CLASS {
  TimerBasicInformation
} TIMER_INFORMATION_CLASS;

typedef struct _TIMER_BASIC_INFORMATION {
  LARGE_INTEGER RemainingTime;
  BOOLEAN TimerState;
} TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION;

typedef VOID(NTAPI* PTIMER_APC_ROUTINE)(_In_ PVOID TimerContext,
                                        _In_ ULONG TimerLowValue,
                                        _In_ LONG TimerHighValue);

typedef enum _TIMER_SET_INFORMATION_CLASS {
  TimerSetCoalescableTimer,
  MaxTimerInfoClass
} TIMER_SET_INFORMATION_CLASS;

typedef struct _TIMER_SET_COALESCABLE_TIMER_INFO {
  _In_ LARGE_INTEGER DueTime;
  _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine;
  _In_opt_ PVOID TimerContext;
  _In_opt_ struct _COUNTED_REASON_CONTEXT* WakeContext;
  _In_opt_ ULONG Period;
  _In_ ULONG TolerableDelay;
  _Out_opt_ PBOOLEAN PreviousState;
} TIMER_SET_COALESCABLE_TIMER_INFO, *PTIMER_SET_COALESCABLE_TIMER_INFO;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE {
  ULONG64 Version;
  UNICODE_STRING Name;
} TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE, *PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE {
  PVOID pValue;
  ULONG ValueLength;
} TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE,
    *PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE;

typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1 {
  UNICODE_STRING Name;
  USHORT ValueType;
  USHORT Reserved;
  ULONG Flags;
  ULONG ValueCount;
  union {
    PLONG64 pInt64;
    PULONG64 pUint64;
    PUNICODE_STRING pString;
    PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE pFqbn;
    PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE pOctetString;
  } Values;
} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;

#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1 1
#define TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION \
  TOKEN_SECURITY_ATTRIBUTES_INFORMATION_VERSION_V1

typedef struct _TOKEN_SECURITY_ATTRIBUTES_INFORMATION {
  USHORT Version;
  USHORT Reserved;
  ULONG AttributeCount;
  union {
    PTOKEN_SECURITY_ATTRIBUTE_V1 pAttributeV1;
  } Attribute;
} TOKEN_SECURITY_ATTRIBUTES_INFORMATION,
    *PTOKEN_SECURITY_ATTRIBUTES_INFORMATION;

typedef enum _FILTER_BOOT_OPTION_OPERATION {
  FilterBootOptionOperationOpenSystemStore,
  FilterBootOptionOperationSetElement,
  FilterBootOptionOperationDeleteElement,
  FilterBootOptionOperationMax
} FILTER_BOOT_OPTION_OPERATION;

typedef enum _IO_SESSION_EVENT {
  IoSessionEventIgnore,
  IoSessionEventCreated,
  IoSessionEventTerminated,
  IoSessionEventConnected,
  IoSessionEventDisconnected,
  IoSessionEventLogon,
  IoSessionEventLogoff,
  IoSessionEventMax
} IO_SESSION_EVENT;

typedef enum _IO_SESSION_STATE {
  IoSessionStateCreated,
  IoSessionStateInitialized,
  IoSessionStateConnected,
  IoSessionStateDisconnected,
  IoSessionStateDisconnectedLoggedOn,
  IoSessionStateLoggedOn,
  IoSessionStateLoggedOff,
  IoSessionStateTerminated,
  IoSessionStateMax
} IO_SESSION_STATE;

typedef struct _PORT_MESSAGE PORT_MESSAGE, *PPORT_MESSAGE;
typedef struct _TP_ALPC TP_ALPC, *PTP_ALPC;

typedef VOID(NTAPI* PTP_ALPC_CALLBACK)(_Inout_ PTP_CALLBACK_INSTANCE Instance,
                                       _Inout_opt_ PVOID Context,
                                       _In_ PTP_ALPC Alpc);

typedef VOID(NTAPI* PTP_ALPC_CALLBACK_EX)(
    _Inout_ PTP_CALLBACK_INSTANCE Instance, _Inout_opt_ PVOID Context,
    _In_ PTP_ALPC Alpc, _In_ PVOID ApcContext);

typedef VOID(NTAPI* PTP_IO_CALLBACK)(_Inout_ PTP_CALLBACK_INSTANCE Instance,
                                     _Inout_opt_ PVOID Context,
                                     _In_ PVOID ApcContext,
                                     _In_ PIO_STATUS_BLOCK IoSB,
                                     _In_ PTP_IO Io);

typedef enum _IO_COMPLETION_INFORMATION_CLASS {
  IoCompletionBasicInformation
} IO_COMPLETION_INFORMATION_CLASS;

typedef struct _IO_COMPLETION_BASIC_INFORMATION {
  LONG Depth;
} IO_COMPLETION_BASIC_INFORMATION, *PIO_COMPLETION_BASIC_INFORMATION;

typedef enum _WORKERFACTORYINFOCLASS {
  WorkerFactoryTimeout,
  WorkerFactoryRetryTimeout,
  WorkerFactoryIdleTimeout,
  WorkerFactoryBindingCount,
  WorkerFactoryThreadMinimum,
  WorkerFactoryThreadMaximum,
  WorkerFactoryPaused,
  WorkerFactoryBasicInformation,
  WorkerFactoryAdjustThreadGoal,
  WorkerFactoryCallbackType,
  WorkerFactoryStackInformation,  // 10
  WorkerFactoryThreadBasePriority,
  WorkerFactoryTimeoutWaiters,  // since THRESHOLD
  WorkerFactoryFlags,
  WorkerFactoryThreadSoftMaximum,
  MaxWorkerFactoryInfoClass
} WORKERFACTORYINFOCLASS,
    *PWORKERFACTORYINFOCLASS;

typedef struct _WORKER_FACTORY_BASIC_INFORMATION {
  LARGE_INTEGER Timeout;
  LARGE_INTEGER RetryTimeout;
  LARGE_INTEGER IdleTimeout;
  BOOLEAN Paused;
  BOOLEAN TimerSet;
  BOOLEAN QueuedToExWorker;
  BOOLEAN MayCreate;
  BOOLEAN CreateInProgress;
  BOOLEAN InsertedIntoQueue;
  BOOLEAN Shutdown;
  ULONG BindingCount;
  ULONG ThreadMinimum;
  ULONG ThreadMaximum;
  ULONG PendingWorkerCount;
  ULONG WaitingWorkerCount;
  ULONG TotalWorkerCount;
  ULONG ReleaseCount;
  LONGLONG InfiniteWaitGoal;
  PVOID StartRoutine;
  PVOID StartParameter;
  HANDLE ProcessId;
  SIZE_T StackReserve;
  SIZE_T StackCommit;
  NTSTATUS LastThreadCreationStatus;
} WORKER_FACTORY_BASIC_INFORMATION, *PWORKER_FACTORY_BASIC_INFORMATION;

typedef struct _BOOT_ENTRY {
  ULONG Version;
  ULONG Length;
  ULONG Id;
  ULONG Attributes;
  ULONG FriendlyNameOffset;
  ULONG BootFilePathOffset;
  ULONG OsOptionsLength;
  UCHAR OsOptions[1];
} BOOT_ENTRY, *PBOOT_ENTRY;

typedef struct _BOOT_ENTRY_LIST {
  ULONG NextEntryOffset;
  BOOT_ENTRY BootEntry;
} BOOT_ENTRY_LIST, *PBOOT_ENTRY_LIST;

typedef struct _BOOT_OPTIONS {
  ULONG Version;
  ULONG Length;
  ULONG Timeout;
  ULONG CurrentBootEntryId;
  ULONG NextBootEntryId;
  WCHAR HeadlessRedirection[1];
} BOOT_OPTIONS, *PBOOT_OPTIONS;

typedef struct _FILE_PATH {
  ULONG Version;
  ULONG Length;
  ULONG Type;
  UCHAR FilePath[1];
} FILE_PATH, *PFILE_PATH;

typedef struct _EFI_DRIVER_ENTRY {
  ULONG Version;
  ULONG Length;
  ULONG Id;
  ULONG FriendlyNameOffset;
  ULONG DriverFilePathOffset;
} EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY;

typedef struct _EFI_DRIVER_ENTRY_LIST {
  ULONG NextEntryOffset;
  EFI_DRIVER_ENTRY DriverEntry;
} EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST;

FORCEINLINE
VOID InitializeListHead(_Out_ PLIST_ENTRY ListHead) {
  ListHead->Flink = ListHead->Blink = ListHead;
}

FORCEINLINE
BOOLEAN
IsListEmpty(_In_ PLIST_ENTRY ListHead) { return ListHead->Flink == ListHead; }

FORCEINLINE
BOOLEAN
RemoveEntryList(_In_ PLIST_ENTRY Entry) {
  PLIST_ENTRY Flink = Entry->Flink;
  PLIST_ENTRY Blink = Entry->Blink;
  Blink->Flink = Flink;
  Flink->Blink = Blink;

  return Flink == Blink;
}

FORCEINLINE
PLIST_ENTRY
RemoveHeadList(_Inout_ PLIST_ENTRY ListHead) {
  PLIST_ENTRY Entry = ListHead->Flink;
  PLIST_ENTRY Flink = Entry->Flink;
  ListHead->Flink = Flink;
  Flink->Blink = ListHead;

  return Entry;
}

FORCEINLINE
PLIST_ENTRY
RemoveTailList(_Inout_ PLIST_ENTRY ListHead) {
  PLIST_ENTRY Entry = ListHead->Blink;
  PLIST_ENTRY Blink = Entry->Blink;
  ListHead->Blink = Blink;
  Blink->Flink = ListHead;

  return Entry;
}

FORCEINLINE
VOID InsertTailList(_Inout_ PLIST_ENTRY ListHead, _Inout_ PLIST_ENTRY Entry) {
  PLIST_ENTRY Blink = ListHead->Blink;
  Entry->Flink = ListHead;
  Entry->Blink = Blink;
  Blink->Flink = Entry;
  ListHead->Blink = Entry;
}

FORCEINLINE
VOID InsertHeadList(_Inout_ PLIST_ENTRY ListHead, _Inout_ PLIST_ENTRY Entry) {
  PLIST_ENTRY Flink = ListHead->Flink;
  Entry->Flink = Flink;
  Entry->Blink = ListHead;
  Flink->Blink = Entry;
  ListHead->Flink = Entry;
}

FORCEINLINE
VOID AppendTailList(_Inout_ PLIST_ENTRY ListHead,
                    _Inout_ PLIST_ENTRY ListToAppend) {
  PLIST_ENTRY ListEnd = ListHead->Blink;

  ListHead->Blink->Flink = ListToAppend;
  ListHead->Blink = ListToAppend->Blink;
  ListToAppend->Blink->Flink = ListHead;
  ListToAppend->Blink = ListEnd;
}

FORCEINLINE
PSINGLE_LIST_ENTRY
PopEntryList(_Inout_ PSINGLE_LIST_ENTRY ListHead) {
  PSINGLE_LIST_ENTRY FirstEntry = ListHead->Next;

  if (FirstEntry) ListHead->Next = FirstEntry->Next;

  return FirstEntry;
}

FORCEINLINE
VOID PushEntryList(_Inout_ PSINGLE_LIST_ENTRY ListHead,
                   _Inout_ PSINGLE_LIST_ENTRY Entry) {
  Entry->Next = ListHead->Next;
  ListHead->Next = Entry;
}

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
                _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable,
                _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort,
                _In_opt_ HANDLE ExceptionPort);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateProcessEx(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
                  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                  _In_ HANDLE ParentProcess, _In_ ULONG Flags,
                  _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort,
                  _In_opt_ HANDLE ExceptionPort, _In_ BOOLEAN InJob);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateUserProcess(_Out_ PHANDLE ProcessHandle, _Out_ PHANDLE ThreadHandle,
                    _In_ ACCESS_MASK ProcessDesiredAccess,
                    _In_ ACCESS_MASK ThreadDesiredAccess,
                    _In_opt_ POBJECT_ATTRIBUTES ProcessObjectAttributes,
                    _In_opt_ POBJECT_ATTRIBUTES ThreadObjectAttributes,
                    _In_ ULONG ProcessFlags, _In_ ULONG ThreadFlags,
                    _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
                    _Inout_ PPS_CREATE_INFO CreateInfo,
                    _In_ PPS_ATTRIBUTE_LIST AttributeList);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationProcess(_In_ HANDLE ProcessHandle,
                        _In_ PROCESSINFOCLASS ProcessInformationClass,
                        _In_ PVOID ProcessInformation,
                        _In_ ULONG ProcessInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationProcess(_In_ HANDLE ProcessHandle,
                          _In_ PROCESSINFOCLASS ProcessInformationClass,
                          _Out_ PVOID ProcessInformation,
                          _In_ ULONG ProcessInformationLength,
                          _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryObject(_In_ HANDLE Handle,
              _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
              _Out_opt_ PVOID ObjectInformation,
              _In_ ULONG ObjectInformationLength,
              _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
                         _Out_opt_ PVOID SystemInformation,
                         _In_ ULONG SystemInformationLength,
                         _Out_opt_ PULONG ReturnLength);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformationEx(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
                           _In_ PVOID InputBuffer, _In_ ULONG InputBufferLength,
                           _Out_ PVOID SystemInformation,
                           _In_ ULONG SystemInformationLength,
                           _Out_opt_ PULONG ReturnLength);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemInformation(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
                       _In_opt_ PVOID SystemInformation,
                       _In_ ULONG SystemInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationThread(_In_ HANDLE ThreadHandle,
                       _In_ THREADINFOCLASS ThreadInformationClass,
                       _In_ PVOID ThreadInformation,
                       _In_ ULONG ThreadInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationThread(_In_ HANDLE ThreadHandle,
                         _In_ THREADINFOCLASS ThreadInformationClass,
                         _Out_ PVOID ThreadInformation,
                         _In_ ULONG ThreadInformationLength,
                         _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnmapViewOfSection(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtExtendSection(_In_ HANDLE SectionHandle,
                _Inout_ PLARGE_INTEGER NewSectionSize);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendThread(_In_ HANDLE ThreadHandle,
                _Out_opt_ PULONG PreviousSuspendCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendProcess(_In_ HANDLE ProcessHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtResumeProcess(_In_ HANDLE ProcessHandle);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
ULONG
NTAPI
NtGetCurrentProcessorNumber();
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSignalAndWaitForSingleObject(_In_ HANDLE SignalHandle, _In_ HANDLE WaitHandle,
                               _In_ BOOLEAN Alertable,
                               _In_opt_ PLARGE_INTEGER Timeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForSingleObject(_In_ HANDLE Handle, _In_ BOOLEAN Alertable,
                      _In_opt_ PLARGE_INTEGER Timeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForMultipleObjects(_In_ ULONG Count, _In_ PHANDLE Handles,
                         _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable,
                         _In_opt_ PLARGE_INTEGER Timeout);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForMultipleObjects32(_In_ ULONG Count, _In_ PHANDLE Handles,
                           _In_ WAIT_TYPE WaitType, _In_ BOOLEAN Alertable,
                           _In_opt_ PLARGE_INTEGER Timeout);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSecurityObject(_In_ HANDLE Handle,
                    _In_ SECURITY_INFORMATION SecurityInformation,
                    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySecurityObject(_In_ HANDLE Handle,
                      _In_ SECURITY_INFORMATION SecurityInformation,
                      _Out_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                      _In_ ULONG Length, _Out_ PULONG LengthNeeded);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueueApcThread(_In_ HANDLE ThreadHandle, _In_ PPS_APC_ROUTINE ApcRoutine,
                 _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2,
                 _In_opt_ PVOID ApcArgument3);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueueApcThreadEx(_In_ HANDLE ThreadHandle,
                   _In_opt_ HANDLE UserApcReserveHandle,
                   _In_ PPS_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcArgument1,
                   _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtProtectVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                       _Inout_ PSIZE_T RegionSize, _In_ ULONG NewProtect,
                       _Out_ PULONG OldProtect);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushBuffersFile(_In_ HANDLE FileHandle,
                   _Out_ PIO_STATUS_BLOCK IoStatusBlock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress,
                        _In_ SIZE_T Length);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushWriteBuffer();

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFsControlFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext,
                _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG FsControlCode,
                _In_opt_ PVOID InputBuffer, _In_ ULONG InputBufferLength,
                _Out_opt_ PVOID OutputBuffer, _In_ ULONG OutputBufferLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLockFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
           _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext,
           _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ PLARGE_INTEGER ByteOffset,
           _In_ PLARGE_INTEGER Length, _In_ ULONG Key,
           _In_ BOOLEAN FailImmediately, _In_ BOOLEAN ExclusiveLock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnlockFile(_In_ HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock,
             _In_ PLARGE_INTEGER ByteOffset, _In_ PLARGE_INTEGER Length,
             _In_ ULONG Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                     _Inout_ PSIZE_T RegionSize,
                     _Out_ PIO_STATUS_BLOCK IoStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress,
                     _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass,
                     _Out_ PVOID MemoryInformation,
                     _In_ SIZE_T MemoryInformationLength,
                     _Out_opt_ PSIZE_T ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                    _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnlockVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                      _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSystemDebugControl(_In_ SYSDBG_COMMAND Command, _Inout_opt_ PVOID InputBuffer,
                     _In_ ULONG InputBufferLength, _Out_opt_ PVOID OutputBuffer,
                     _In_ ULONG OutputBufferLength,
                     _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtYieldExecution();

NTSYSCALLAPI
NTSTATUS
NTAPI
NtClose(_In_ HANDLE Handle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryAttributesFile(_In_ POBJECT_ATTRIBUTES ObjectAttributes,
                      _Out_ PFILE_BASIC_INFORMATION FileInformation);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryFullAttributesFile(_In_ POBJECT_ATTRIBUTES ObjectAttributes,
                          _Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationFile(_In_ HANDLE FileHandle,
                       _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                       _Out_ PVOID FileInformation, _In_ ULONG Length,
                       _In_ FILE_INFORMATION_CLASS FileInformationClass);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationFile(_In_ HANDLE FileHandle,
                     _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                     _In_ PVOID FileInformation, _In_ ULONG Length,
                     _In_ FILE_INFORMATION_CLASS FileInformationClass);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetQuotaInformationFile(_In_ HANDLE FileHandle,
                          _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                          _In_ PVOID Buffer, _In_ ULONG Length);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetVolumeInformationFile(_In_ HANDLE FileHandle,
                           _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                           _In_ PVOID FsInformation, _In_ ULONG Length,
                           _In_ FS_INFORMATION_CLASS FsInformationClass);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess,
             _In_ POBJECT_ATTRIBUTES ObjectAttributes,
             _Out_ PIO_STATUS_BLOCK IoStatusBlock,
             _In_opt_ PLARGE_INTEGER AllocationSize, _In_ ULONG FileAttributes,
             _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition,
             _In_ ULONG CreateOptions, _In_opt_ PVOID EaBuffer,
             _In_ ULONG EaLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateNamedPipeFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess,
                      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                      _In_ ULONG ShareAccess, _In_ ULONG CreateDisposition,
                      _In_ ULONG CreateOptions, _In_ ULONG NamedPipeType,
                      _In_ ULONG ReadMode, _In_ ULONG CompletionMode,
                      _In_ ULONG MaximumInstances, _In_ ULONG InboundQuota,
                      _In_ ULONG OutboundQuota,
                      _In_opt_ PLARGE_INTEGER DefaultTimeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateMailslotFile(_Out_ PHANDLE FileHandle, _In_ ULONG DesiredAccess,
                     _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                     _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                     _In_ ULONG CreateOptions, _In_ ULONG MailslotQuota,
                     _In_ ULONG MaximumMessageSize,
                     _In_ PLARGE_INTEGER ReadTimeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelIoFile(_In_ HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelIoFileEx(_In_ HANDLE FileHandle,
                 _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
                 _Out_ PIO_STATUS_BLOCK IoStatusBlock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelSynchronousIoFile(_In_ HANDLE ThreadHandle,
                          _In_opt_ PIO_STATUS_BLOCK IoRequestToCancel,
                          _Out_ PIO_STATUS_BLOCK IoStatusBlock);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSymbolicLinkObject(_Out_ PHANDLE LinkHandle,
                           _In_ ACCESS_MASK DesiredAccess,
                           _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                           _In_ PUNICODE_STRING LinkTarget);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSymbolicLinkObject(_Out_ PHANDLE LinkHandle,
                         _In_ ACCESS_MASK DesiredAccess,
                         _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySymbolicLinkObject(_In_ HANDLE LinkHandle,
                          _Inout_ PUNICODE_STRING LinkTarget,
                          _Out_opt_ PULONG ReturnedLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetContextThread(_In_ HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetContextThread(_In_ HANDLE ThreadHandle, _In_ PCONTEXT ThreadContext);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_ POBJECT_ATTRIBUTES ObjectAttributes,
              _In_opt_ PCLIENT_ID ClientId);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateProcess(_In_opt_ HANDLE ProcessHandle, _In_ NTSTATUS ExitStatus);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetNextProcess(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
                 _In_ ULONG HandleAttributes, _In_ ULONG Flags,
                 _Out_ PHANDLE NewProcessHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetNextThread(_In_ HANDLE ProcessHandle, _In_ HANDLE ThreadHandle,
                _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes,
                _In_ ULONG Flags, _Out_ PHANDLE NewThreadHandle);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateDebugObject(_Out_ PHANDLE DebugObjectHandle,
                    _In_ ACCESS_MASK DesiredAccess,
                    _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG Flags);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDebugActiveProcess(_In_ HANDLE ProcessHandle, _In_ HANDLE DebugObjectHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtContinue(_In_ PCONTEXT ContextRecord, _In_ BOOLEAN TestAlert);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRaiseException(_In_ PEXCEPTION_RECORD ExceptionRecord,
                 _In_ PCONTEXT ContextRecord, _In_ BOOLEAN FirstChance);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess,
               _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
               _In_ HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId,
               _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB InitialTeb,
               _In_ BOOLEAN CreateSuspended);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateThreadEx(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess,
                 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                 _In_ HANDLE ProcessHandle,
                 _In_ PUSER_THREAD_START_ROUTINE StartRoutine,
                 _In_opt_ PVOID Argument, _In_ ULONG CreateFlags,
                 _In_opt_ ULONG_PTR ZeroBits, _In_opt_ SIZE_T StackSize,
                 _In_opt_ SIZE_T MaximumStackSize,
                 _In_opt_ PPS_ATTRIBUTE_LIST AttributeList);
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateReserveObject(_Out_ PHANDLE MemoryReserveHandle,
                        _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                        _In_ MEMORY_RESERVE_TYPE Type);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRegisterThreadTerminatePort(_In_ HANDLE PortHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRaiseHardError(_In_ NTSTATUS ErrorStatus, _In_ ULONG NumberOfParameters,
                 _In_opt_ ULONG UnicodeStringParameterMask,
                 _In_ PULONG_PTR Parameters,
                 _In_ HARDERROR_RESPONSE_OPTION ResponseOption,
                 _Out_ PHARDERROR_RESPONSE Response);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                        _In_ ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize,
                        _In_ ULONG AllocationType, _In_ ULONG Protect);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreeVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress,
                    _Inout_ PSIZE_T RegionSize, _In_ ULONG FreeType);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadVirtualMemory(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress,
                    _Out_ PVOID Buffer, _In_ SIZE_T BufferSize,
                    _Out_opt_ PSIZE_T NumberOfBytesRead);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress,
                     _In_ CONST VOID* Buffer, _In_ SIZE_T BufferSize,
                     _Out_opt_ PSIZE_T NumberOfBytesWritten);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateUserPhysicalPages(_In_ HANDLE ProcessHandle,
                            _Inout_ PULONG_PTR NumberOfPages,
                            _Out_ PULONG_PTR UserPfnArray);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapUserPhysicalPages(_In_ PVOID VirtualAddress, _In_ ULONG_PTR NumberOfPages,
                       _In_ PULONG_PTR UserPfnArray);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapUserPhysicalPagesScatter(_In_ PVOID* VirtualAddresses,
                              _In_ ULONG_PTR NumberOfPages,
                              _In_ PULONG_PTR UserPfnArray);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreeUserPhysicalPages(_In_ HANDLE ProcessHandle,
                        _Inout_ PULONG_PTR NumberOfPages,
                        _In_ PULONG_PTR UserPfnArray);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySection(_In_ HANDLE SectionHandle,
               _In_ SECTION_INFORMATION_CLASS SectionInformationClass,
               _Out_ PVOID SectionInformation,
               _In_ SIZE_T SectionInformationLength,
               _Out_opt_ PSIZE_T ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAreMappedFilesTheSame(_In_ PVOID File1MappedAsAnImage,
                        _In_ PVOID File2MappedAsFile);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess,
                _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                _In_opt_ PLARGE_INTEGER MaximumSize,
                _In_ ULONG SectionPageProtection,
                _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtMapViewOfSection(_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle,
                   _Inout_ PVOID* BaseAddress, _In_ ULONG_PTR ZeroBits,
                   _In_ SIZE_T CommitSize,
                   _Inout_opt_ PLARGE_INTEGER SectionOffset,
                   _Inout_ PSIZE_T ViewSize,
                   _In_ SECTION_INHERIT InheritDisposition,
                   _In_ ULONG AllocationType, _In_ ULONG Win32Protect);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSession(_Out_ PHANDLE SessionHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_ POBJECT_ATTRIBUTES ObjectAttributes);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeDirectoryFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                            _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                            _In_opt_ PVOID ApcContext,
                            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                            _Out_ FILE_NOTIFY_INFORMATION Buffer,
                            _In_ ULONG Length, _In_ ULONG CompletionFilter,
                            _In_ BOOLEAN WatchTree);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess,
           _In_ POBJECT_ATTRIBUTES ObjectAttributes,
           _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess,
           _In_ ULONG OpenOptions);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDirectoryFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                     _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                     _In_opt_ PVOID ApcContext,
                     _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                     _Out_ PVOID FileInformation, _In_ ULONG Length,
                     _In_ FILE_INFORMATION_CLASS FileInformationClass,
                     _In_ BOOLEAN ReturnSingleEntry,
                     _In_opt_ PUNICODE_STRING FileName,
                     _In_ BOOLEAN RestartScan);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryEaFile(_In_ HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock,
              _Out_ PVOID Buffer, _In_ ULONG Length,
              _In_ BOOLEAN ReturnSingleEntry, _In_ PVOID EaList,
              _In_ ULONG EaListLength, _In_opt_ PULONG EaIndex,
              _In_ BOOLEAN RestartScan);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEaFile(_In_ HANDLE FileHandle, _Out_ PIO_STATUS_BLOCK IoStatusBlock,
            _In_ PVOID Buffer, _In_ ULONG Length);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadDriver(_In_ PUNICODE_STRING DriverServiceName);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadDriver(_In_ PUNICODE_STRING DriverServiceName);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
           _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext,
           _Out_ PIO_STATUS_BLOCK IoStatusBlock, _Out_ PVOID Buffer,
           _In_ ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset,
           _In_opt_ PULONG Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadFileScatter(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                  _In_opt_ PVOID ApcContext,
                  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                  _In_ PFILE_SEGMENT_ELEMENT SegmentArray, _In_ ULONG Length,
                  _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWriteFileGather(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                  _In_opt_ PVOID ApcContext,
                  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                  _In_ PFILE_SEGMENT_ELEMENT SegmentArray, _In_ ULONG Length,
                  _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteFile(_In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWriteFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
            _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext,
            _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ PVOID Buffer,
            _In_ ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset,
            _In_opt_ PULONG Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeviceIoControlFile(_In_ HANDLE FileHandle, _In_opt_ HANDLE Event,
                      _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                      _In_opt_ PVOID ApcContext,
                      _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                      _In_ ULONG IoControlCode, _In_opt_ PVOID InputBuffer,
                      _In_ ULONG InputBufferLength,
                      _Out_opt_ PVOID OutputBuffer,
                      _In_ ULONG OutputBufferLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationObject(_In_ HANDLE Handle,
                       _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
                       _In_ PVOID ObjectInformation,
                       _In_ ULONG ObjectInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDuplicateObject(_In_ HANDLE SourceProcessHandle, _In_ HANDLE SourceHandle,
                  _In_opt_ HANDLE TargetProcessHandle,
                  _Out_opt_ PHANDLE TargetHandle,
                  _In_ ACCESS_MASK DesiredAccess, _In_ ULONG HandleAttributes,
                  _In_ ULONG Options);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtMakePermanentObject(_In_ HANDLE Object);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtMakeTemporaryObject(_In_ HANDLE Handle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateDirectoryObject(_Out_ PHANDLE DirectoryHandle,
                        _In_ ACCESS_MASK DesiredAccess,
                        _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenDirectoryObject(_Out_ PHANDLE DirectoryHandle,
                      _In_ ACCESS_MASK DesiredAccess,
                      _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDirectoryObject(_In_ HANDLE DirectoryHandle, _Out_ PVOID Buffer,
                       _In_ ULONG BufferLength, _In_ BOOLEAN ReturnSingleEntry,
                       _In_ BOOLEAN RestartScan, _Inout_ PULONG Context,
                       _Out_opt_ PULONG ReturnLength);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreatePrivateNamespace(_Out_ PHANDLE NamespaceHandle,
                         _In_ ACCESS_MASK DesiredAccess,
                         _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                         _In_ PVOID BoundaryDescriptor);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenPrivateNamespace(_Out_ PHANDLE NamespaceHandle,
                       _In_ ACCESS_MASK DesiredAccess,
                       _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                       _In_ PVOID BoundaryDescriptor);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeletePrivateNamespace(_In_ HANDLE NamespaceHandle);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThread(_Out_ PHANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess,
             _In_ POBJECT_ATTRIBUTES ObjectAttributes,
             _In_opt_ PCLIENT_ID ClientId);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtTerminateThread(_In_opt_ HANDLE ThreadHandle, _In_ NTSTATUS ExitStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemTime(_Out_ PLARGE_INTEGER SystemTime);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemTime(_In_opt_ PLARGE_INTEGER SystemTime,
                _Out_opt_ PLARGE_INTEGER PreviousTime);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimerResolution(_Out_ PULONG MaximumTime, _Out_ PULONG MinimumTime,
                       _Out_ PULONG CurrentTime);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimerResolution(_In_ ULONG DesiredTime, _In_ BOOLEAN SetResolution,
                     _Out_ PULONG ActualTime);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryPerformanceCounter(_Out_ PLARGE_INTEGER PerformanceCounter,
                          _Out_opt_ PLARGE_INTEGER PerformanceFrequency);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateLocallyUniqueId(_Out_ PLUID Luid);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetUuidSeed(_In_ PCHAR Seed);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAllocateUuids(_Out_ PULARGE_INTEGER Time, _Out_ PULONG Range,
                _Out_ PULONG Sequence, _Out_ PCHAR Seed);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateEvent(_Out_ PHANDLE EventHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
              _In_ EVENT_TYPE EventType, _In_ BOOLEAN InitialState);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenEvent(_Out_ PHANDLE EventHandle, _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetEvent(_In_ HANDLE EventHandle, _Out_opt_ PLONG PreviousState);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtResetEvent(_In_ HANDLE EventHandle, _Out_opt_ PLONG PreviousState);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtClearEvent(_In_ HANDLE EventHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryQuotaInformationFile(_In_ HANDLE FileHandle,
                            _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                            _Out_ PVOID Buffer, _In_ ULONG Length,
                            _In_ BOOLEAN ReturnSingleEntry,
                            _In_opt_ PVOID SidList, _In_ ULONG SidListLength,
                            _In_opt_ PSID StartSid, _In_ BOOLEAN RestartScan);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryVolumeInformationFile(_In_ HANDLE FileHandle,
                             _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                             _Out_ PVOID FsInformation, _In_ ULONG Length,
                             _In_ FS_INFORMATION_CLASS FsInformationClass);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKey(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes,
            _Reserved_ ULONG TitleIndex, _In_opt_ PUNICODE_STRING Class,
            _In_ ULONG CreateOptions, _Out_opt_ PULONG Disposition);

#if NTDDI_VERSION >= PNTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKeyTransacted(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
                      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                      _Reserved_ ULONG TitleIndex,
                      _In_opt_ PUNICODE_STRING Class, _In_ ULONG CreateOptions,
                      _In_ HANDLE TransactionHandle,
                      _Out_opt_ PULONG Disposition);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKey(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
          _In_ POBJECT_ATTRIBUTES ObjectAttributes);

#if NTDDI_VERSION >= PNTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyTransacted(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
                    _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                    _In_ HANDLE TransactionHandle);
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyEx(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG OpenOptions);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyTransactedEx(_Out_ PHANDLE KeyHandle, _In_ ACCESS_MASK DesiredAccess,
                      _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                      _In_ ULONG OpenOptions, _In_ HANDLE TransactionHandle);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteKey(_In_ HANDLE KeyHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRenameKey(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING NewName);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteValueKey(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryKey(_In_ HANDLE KeyHandle,
           _In_ KEY_INFORMATION_CLASS KeyInformationClass,
           _Out_ PVOID KeyInformation, _In_ ULONG Length,
           _Out_ PULONG ResultLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationKey(_In_ HANDLE KeyHandle,
                    _In_ KEY_SET_INFORMATION_CLASS KeySetInformationClass,
                    _In_ PVOID KeySetInformation,
                    _In_ ULONG KeySetInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryValueKey(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName,
                _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
                _Out_ PVOID KeyValueInformation, _In_ ULONG Length,
                _Out_ PULONG ResultLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetValueKey(_In_ HANDLE KeyHandle, _In_ PUNICODE_STRING ValueName,
              _In_opt_ ULONG TitleIndex, _In_ ULONG Type, _In_ PVOID Data,
              _In_ ULONG DataSize);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryMultipleValueKey(_In_ HANDLE KeyHandle,
                        _Inout_ PKEY_VALUE_ENTRY ValueEntries,
                        _In_ ULONG EntryCount, _Out_ PVOID ValueBuffer,
                        _Inout_ PULONG BufferLength,
                        _Out_opt_ PULONG RequiredBufferLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateKey(_In_ HANDLE KeyHandle, _In_ ULONG Index,
               _In_ KEY_INFORMATION_CLASS KeyInformationClass,
               _Out_ PVOID KeyInformation, _In_ ULONG Length,
               _Out_ PULONG ResultLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateValueKey(_In_ HANDLE KeyHandle, _In_ ULONG Index,
                    _In_ KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,
                    _Out_ PVOID KeyValueInformation, _In_ ULONG Length,
                    _Out_ PULONG ResultLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushKey(_In_ HANDLE KeyHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompactKeys(_In_ ULONG Count, _In_ PHANDLE KeyArray);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompressKey(_In_ HANDLE Key);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKey(_In_ POBJECT_ATTRIBUTES TargetKey,
          _In_ POBJECT_ATTRIBUTES SourceFile);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKey2(_In_ POBJECT_ATTRIBUTES TargetKey,
           _In_ POBJECT_ATTRIBUTES SourceFile, _In_ ULONG Flags);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
NTSTATUS
NTAPI
NtLoadKeyEx(_In_ POBJECT_ATTRIBUTES TargetKey,
            _In_ POBJECT_ATTRIBUTES SourceFile, _In_ ULONG Flags,
            _In_opt_ HANDLE TrustClassKey, _In_opt_ HANDLE Event,
            _In_opt_ ACCESS_MASK DesiredAccess, _Out_opt_ PHANDLE RootHandle,
            _Out_opt_ PIO_STATUS_BLOCK IoStatus);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReplaceKey(_In_ POBJECT_ATTRIBUTES NewFile, _In_ HANDLE TargetHandle,
             _In_ POBJECT_ATTRIBUTES OldFile);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSaveKey(_In_ HANDLE KeyHandle, _In_ HANDLE FileHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSaveKeyEx(_In_ HANDLE KeyHandle, _In_ HANDLE FileHandle, _In_ ULONG Format);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSaveMergedKeys(_In_ HANDLE HighPrecedenceKeyHandle,
                 _In_ HANDLE LowPrecedenceKeyHandle, _In_ HANDLE FileHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRestoreKey(_In_ HANDLE KeyHandle, _In_ HANDLE FileHandle, _In_ ULONG Flags);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadKey(_In_ POBJECT_ATTRIBUTES TargetKey);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadKey2(_In_ POBJECT_ATTRIBUTES TargetKey, _In_ ULONG Flags);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadKeyEx(_In_ POBJECT_ATTRIBUTES TargetKey, _In_opt_ HANDLE Event);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeKey(_In_ HANDLE KeyHandle, _In_opt_ HANDLE Event,
                  _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                  _In_opt_ PVOID ApcContext,
                  _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                  _In_ ULONG CompletionFilter, _In_ BOOLEAN WatchTree,
                  _Out_ PVOID Buffer, _In_ ULONG BufferSize,
                  _In_ BOOLEAN Asynchronous);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeMultipleKeys(_In_ HANDLE MasterKeyHandle, _In_opt_ ULONG Count,
                           _In_ POBJECT_ATTRIBUTES SubordinateObjects,
                           _In_opt_ HANDLE Event,
                           _In_opt_ PIO_APC_ROUTINE ApcRoutine,
                           _In_opt_ PVOID ApcContext,
                           _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                           _In_ ULONG CompletionFilter, _In_ BOOLEAN WatchTree,
                           _Out_ PVOID Buffer, _In_ ULONG BufferSize,
                           _In_ BOOLEAN Asynchronous);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryOpenSubKeys(_In_ POBJECT_ATTRIBUTES TargetKey, _Out_ PULONG HandleCount);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryOpenSubKeysEx(_In_ POBJECT_ATTRIBUTES TargetKey, _In_ ULONG BufferLength,
                     _Out_ PVOID Buffer, _Out_ PULONG RequiredSize);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtInitializeRegistry(_In_ USHORT BootCondition);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLockRegistryKey(_In_ HANDLE KeyHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtLockProductActivationKeys(_Inout_opt_ ULONG* pPrivateVer,
                            _Out_opt_ ULONG* pSafeMode);

#if NTDDI_VERSION >= PNTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreezeRegistry(_In_ ULONG TimeOutInSeconds);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtThawRegistry();
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(_In_ BOOLEAN Alertable, _In_ PLARGE_INTEGER DelayInterval);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCallbackReturn(_In_ PVOID OutputBuffer, _In_ ULONG OutputLength,
                 _In_ NTSTATUS Status);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
VOID NTAPI NtFlushProcessWriteBuffers();
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDebugFilterState(_In_ ULONG ComponentId, _In_ ULONG Level);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDebugFilterState(_In_ ULONG ComponentId, _In_ ULONG Level,
                      _In_ BOOLEAN State);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRemoveProcessDebug(_In_ HANDLE ProcessHandle, _In_ HANDLE DebugObjectHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForDebugEvent(_In_ HANDLE DebugObjectHandle, _In_ BOOLEAN Alertable,
                    _In_opt_ PLARGE_INTEGER Timeout,
                    _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDebugContinue(_In_ HANDLE DebugObjectHandle, _In_ PCLIENT_ID ClientId,
                _In_ NTSTATUS ContinueStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationDebugObject(
    _In_ HANDLE DebugObjectHandle,
    _In_ DEBUGOBJECTINFOCLASS DebugObjectInformationClass,
    _In_ PVOID DebugInformation, _In_ ULONG DebugInformationLength,
    _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcessToken(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
                   _Out_ PHANDLE TokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenProcessTokenEx(_In_ HANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess,
                     _In_ ULONG HandleAttributes, _Out_ PHANDLE TokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThreadToken(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess,
                  _In_ BOOLEAN OpenAsSelf, _Out_ PHANDLE TokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThreadTokenEx(_In_ HANDLE ThreadHandle, _In_ ACCESS_MASK DesiredAccess,
                    _In_ BOOLEAN OpenAsSelf, _In_ ULONG HandleAttributes,
                    _Out_ PHANDLE TokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateToken(_Out_ PHANDLE TokenHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
              _In_ TOKEN_TYPE TokenType, _In_ PLUID AuthenticationId,
              _In_ PLARGE_INTEGER ExpirationTime, _In_ PTOKEN_USER User,
              _In_ PTOKEN_GROUPS Groups, _In_ PTOKEN_PRIVILEGES Privileges,
              _In_opt_ PTOKEN_OWNER Owner,
              _In_ PTOKEN_PRIMARY_GROUP PrimaryGroup,
              _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl,
              _In_ PTOKEN_SOURCE TokenSource);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDuplicateToken(_In_ HANDLE ExistingTokenHandle,
                 _In_ ACCESS_MASK DesiredAccess,
                 _In_ POBJECT_ATTRIBUTES ObjectAttributes,
                 _In_ BOOLEAN EffectiveOnly, _In_ TOKEN_TYPE TokenType,
                 _Out_ PHANDLE NewTokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAdjustPrivilegesToken(_In_ HANDLE TokenHandle,
                        _In_ BOOLEAN DisableAllPrivileges,
                        _In_opt_ PTOKEN_PRIVILEGES NewState,
                        _In_ ULONG BufferLength,
                        _Out_opt_ PTOKEN_PRIVILEGES PreviousState,
                        _Out_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAdjustGroupsToken(_In_ HANDLE TokenHandle, _In_ BOOLEAN ResetToDefault,
                    _In_opt_ PTOKEN_GROUPS NewState,
                    _In_opt_ ULONG BufferLength,
                    _Out_ PTOKEN_GROUPS PreviousState,
                    _Out_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFilterToken(_In_ HANDLE ExistingTokenHandle, _In_ ULONG Flags,
              _In_opt_ PTOKEN_GROUPS SidsToDisable,
              _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete,
              _In_opt_ PTOKEN_GROUPS RestrictedSids,
              _Out_ PHANDLE NewTokenHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationToken(_In_ HANDLE TokenHandle,
                      _In_ TOKEN_INFORMATION_CLASS TokenInformationClass,
                      _In_ PVOID TokenInformation,
                      _In_ ULONG TokenInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCompareTokens(_In_ HANDLE FirstTokenHandle, _In_ HANDLE SecondTokenHandle,
                _Out_ PBOOLEAN Equal);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrivilegeCheck(_In_ HANDLE ClientToken,
                 _Inout_ PPRIVILEGE_SET RequiredPrivileges,
                 _Out_ PBOOLEAN Result);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtImpersonateAnonymousToken(_In_ HANDLE ThreadHandle);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySecurityAttributesToken(
    _In_ HANDLE TokenHandle,
    _In_reads_opt_(NumberOfAttributes) PUNICODE_STRING Attributes,
    _In_ ULONG NumberOfAttributes,
    _Out_ PTOKEN_SECURITY_ATTRIBUTES_INFORMATION Buffer, _In_ ULONG Length,
    _Out_ PULONG ReturnLength);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheck(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
              _In_ HANDLE ClientToken, _In_ ACCESS_MASK DesiredAccess,
              _In_ PGENERIC_MAPPING GenericMapping,
              _Out_ PPRIVILEGE_SET PrivilegeSet,
              _Inout_ PULONG PrivilegeSetLength,
              _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheckByType(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken,
    _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_TYPE_LIST ObjectTypeList,
    _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping,
    _Out_ PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength,
    _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheckByTypeResultList(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_opt_ PSID PrincipalSelfSid, _In_ HANDLE ClientToken,
    _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_TYPE_LIST ObjectTypeList,
    _In_ ULONG ObjectTypeListLength, _In_ PGENERIC_MAPPING GenericMapping,
    _Out_ PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength,
    _Out_ PACCESS_MASK GrantedAccess, _Out_ PNTSTATUS AccessStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateIoCompletion(_Out_ PHANDLE IoCompletionHandle,
                     _In_ ACCESS_MASK DesiredAccess,
                     _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                     _In_opt_ ULONG Count);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenIoCompletion(_Out_ PHANDLE IoCompletionHandle,
                   _In_ ACCESS_MASK DesiredAccess,
                   _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryIoCompletion(
    _In_ HANDLE IoCompletionHandle,
    _In_ IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass,
    _Out_ PVOID IoCompletionInformation,
    _In_ ULONG IoCompletionInformationLength, _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetIoCompletion(_In_ HANDLE IoCompletionHandle, _In_opt_ PVOID KeyContext,
                  _In_opt_ PVOID ApcContext, _In_ NTSTATUS IoStatus,
                  _In_ ULONG_PTR IoStatusInformation);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetIoCompletionEx(_In_ HANDLE IoCompletionHandle,
                    _In_ HANDLE IoCompletionPacketHandle,
                    _In_opt_ PVOID KeyContext, _In_opt_ PVOID ApcContext,
                    _In_ NTSTATUS IoStatus, _In_ ULONG_PTR IoStatusInformation);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRemoveIoCompletion(_In_ HANDLE IoCompletionHandle, _Out_ PVOID* KeyContext,
                     _Out_ PVOID* ApcContext,
                     _Out_ PIO_STATUS_BLOCK IoStatusBlock,
                     _In_opt_ PLARGE_INTEGER Timeout);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRemoveIoCompletionEx(_In_ HANDLE IoCompletionHandle,
                       _Out_ PFILE_IO_COMPLETION_INFORMATION
                           IoCompletionInformation,
                       _In_ ULONG Count, _Out_ PULONG NumEntriesRemoved,
                       _In_opt_ PLARGE_INTEGER Timeout, _In_ BOOLEAN Alertable);
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtNotifyChangeSession(_In_ HANDLE SessionHandle,
                      _In_ ULONG ChangeSequenceNumber,
                      _In_ PLARGE_INTEGER ChangeTimeStamp,
                      _In_ IO_SESSION_EVENT Event,
                      _In_ IO_SESSION_STATE NewState,
                      _In_ IO_SESSION_STATE PreviousState, _In_ PVOID Payload,
                      _In_ ULONG PayloadSize);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateMutant(_Out_ PHANDLE MutantHandle, _In_ ACCESS_MASK DesiredAccess,
               _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
               _In_ BOOLEAN InitialOwner);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenMutant(_Out_ PHANDLE MutantHandle, _In_ ACCESS_MASK DesiredAccess,
             _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseMutant(_In_ HANDLE MutantHandle, _Out_opt_ PLONG PreviousCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAlertThread(_In_ HANDLE ThreadHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAlertResumeThread(_In_ HANDLE ThreadHandle,
                    _Out_opt_ PULONG PreviousSuspendCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtTestAlert();

NTSYSCALLAPI
NTSTATUS
NTAPI
NtImpersonateThread(_In_ HANDLE ServerThreadHandle,
                    _In_ HANDLE ClientThreadHandle,
                    _In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateSemaphore(_Out_ PHANDLE SemaphoreHandle, _In_ ACCESS_MASK DesiredAccess,
                  _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                  _In_ LONG InitialCount, _In_ LONG MaximumCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenSemaphore(_Out_ PHANDLE SemaphoreHandle, _In_ ACCESS_MASK DesiredAccess,
                _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseSemaphore(_In_ HANDLE SemaphoreHandle, _In_ LONG ReleaseCount,
                   _Out_opt_ PLONG PreviousCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySemaphore(_In_ HANDLE SemaphoreHandle,
                 _In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,
                 _Out_ PVOID SemaphoreInformation,
                 _In_ ULONG SemaphoreInformationLength,
                 _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTimer(_Out_ PHANDLE TimerHandle, _In_ ACCESS_MASK DesiredAccess,
              _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
              _In_ TIMER_TYPE TimerType);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenTimer(_Out_ PHANDLE TimerHandle, _In_ ACCESS_MASK DesiredAccess,
            _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimer(_In_ HANDLE TimerHandle, _In_ PLARGE_INTEGER DueTime,
           _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine,
           _In_opt_ PVOID TimerContext, _In_ BOOLEAN ResumeTimer,
           _In_opt_ LONG Period, _Out_opt_ PBOOLEAN PreviousState);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetTimerEx(_In_ HANDLE TimerHandle,
             _In_ TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
             _Inout_ PVOID TimerSetInformation,
             _In_ ULONG TimerSetInformationLength);
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelTimer(_In_ HANDLE TimerHandle, _Out_opt_ PBOOLEAN CurrentState);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimer(_In_ HANDLE TimerHandle,
             _In_ TIMER_INFORMATION_CLASS TimerInformationClass,
             _Out_ PVOID TimerInformation, _In_ ULONG TimerInformationLength,
             _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKeyedEvent(_Out_ PHANDLE KeyedEventHandle,
                   _In_ ACCESS_MASK DesiredAccess,
                   _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                   _In_ ULONG Flags);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenKeyedEvent(_Out_ PHANDLE KeyedEventHandle, _In_ ACCESS_MASK DesiredAccess,
                 _In_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseKeyedEvent(_In_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue,
                    _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForKeyedEvent(_In_ HANDLE KeyedEventHandle, _In_ PVOID KeyValue,
                    _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUmsThreadYield(_In_ PVOID SchedulerParam);
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTransactionManager(_Out_ PHANDLE TmHandle,
                           _In_ ACCESS_MASK DesiredAccess,
                           _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                           _In_opt_ PUNICODE_STRING LogFileName,
                           _In_opt_ ULONG CreateOptions,
                           _In_opt_ ULONG CommitStrength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenTransactionManager(_Out_ PHANDLE TmHandle, _In_ ACCESS_MASK DesiredAccess,
                         _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                         _In_opt_ PUNICODE_STRING LogFileName,
                         _In_opt_ LPGUID TmIdentity,
                         _In_opt_ ULONG OpenOptions);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRenameTransactionManager(_In_ PUNICODE_STRING LogFileName,
                           _In_ LPGUID ExistingTransactionManagerGuid);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRollforwardTransactionManager(_In_ HANDLE TransactionManagerHandle,
                                _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRecoverTransactionManager(_In_ HANDLE TransactionManagerHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationTransactionManager(_In_ HANDLE TransactionManagerHandle,
                                     _In_ TRANSACTIONMANAGER_INFORMATION_CLASS
                                         TransactionManagerInformationClass,
                                     _Out_ PVOID TransactionManagerInformation,
                                     _In_ ULONG
                                         TransactionManagerInformationLength,
                                     _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationTransactionManager(_In_opt_ HANDLE TmHandle,
                                   _In_ TRANSACTIONMANAGER_INFORMATION_CLASS
                                       TransactionManagerInformationClass,
                                   _In_ PVOID TransactionManagerInformation,
                                   _In_ ULONG
                                       TransactionManagerInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateTransactionObject(_In_opt_ HANDLE RootObjectHandle,
                             _In_ KTMOBJECT_TYPE QueryType,
                             _Inout_updates_bytes_(ObjectCursorLength)
                                 PKTMOBJECT_CURSOR ObjectCursor,
                             _In_ ULONG ObjectCursorLength,
                             _Out_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTransaction(_Out_ PHANDLE TransactionHandle,
                    _In_ ACCESS_MASK DesiredAccess,
                    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                    _In_opt_ LPGUID Uow, _In_opt_ HANDLE TmHandle,
                    _In_opt_ ULONG CreateOptions, _In_opt_ ULONG IsolationLevel,
                    _In_opt_ ULONG IsolationFlags,
                    _In_opt_ PLARGE_INTEGER Timeout,
                    _In_opt_ PUNICODE_STRING Description);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenTransaction(_Out_ PHANDLE TransactionHandle,
                  _In_ ACCESS_MASK DesiredAccess,
                  _In_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ LPGUID Uow,
                  _In_opt_ HANDLE TmHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationTransaction(
    _In_ HANDLE TransactionHandle,
    _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
    _Out_ PVOID TransactionInformation, _In_ ULONG TransactionInformationLength,
    _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationTransaction(
    _In_ HANDLE TransactionHandle,
    _In_ TRANSACTION_INFORMATION_CLASS TransactionInformationClass,
    _In_ PVOID TransactionInformation, _In_ ULONG TransactionInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCommitTransaction(_In_ HANDLE TransactionHandle, _In_ BOOLEAN Wait);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRollbackTransaction(_In_ HANDLE TransactionHandle, _In_ BOOLEAN Wait);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateEnlistment(
    _Out_ PHANDLE EnlistmentHandle, _In_ ACCESS_MASK DesiredAccess,
    _In_ HANDLE ResourceManagerHandle, _In_ HANDLE TransactionHandle,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ ULONG CreateOptions,
    _In_ NOTIFICATION_MASK NotificationMask, _In_opt_ PVOID EnlistmentKey);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenEnlistment(_Out_ PHANDLE EnlistmentHandle, _In_ ACCESS_MASK DesiredAccess,
                 _In_ HANDLE ResourceManagerHandle, _In_ LPGUID EnlistmentGuid,
                 _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationEnlistment(
    _In_ HANDLE EnlistmentHandle,
    _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
    _Out_ PVOID EnlistmentInformation, _In_ ULONG EnlistmentInformationLength,
    _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationEnlistment(
    _In_opt_ HANDLE EnlistmentHandle,
    _In_ ENLISTMENT_INFORMATION_CLASS EnlistmentInformationClass,
    _In_ PVOID EnlistmentInformation, _In_ ULONG EnlistmentInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRecoverEnlistment(_In_ HANDLE EnlistmentHandle, _In_opt_ PVOID EnlistmentKey);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrePrepareEnlistment(_In_ HANDLE EnlistmentHandle,
                       _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrepareEnlistment(_In_ HANDLE EnlistmentHandle,
                    _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCommitEnlistment(_In_ HANDLE EnlistmentHandle,
                   _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRollbackEnlistment(_In_ HANDLE EnlistmentHandle,
                     _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrePrepareComplete(_In_ HANDLE EnlistmentHandle,
                     _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPrepareComplete(_In_ HANDLE EnlistmentHandle,
                  _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCommitComplete(_In_ HANDLE EnlistmentHandle,
                 _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReadOnlyEnlistment(_In_ HANDLE EnlistmentHandle,
                     _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRollbackComplete(_In_ HANDLE EnlistmentHandle,
                   _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSinglePhaseReject(_In_ HANDLE EnlistmentHandle,
                    _In_opt_ PLARGE_INTEGER TmVirtualClock);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateResourceManager(_Out_ PHANDLE ResourceManagerHandle,
                        _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE TmHandle,
                        _In_ LPGUID RmGuid,
                        _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
                        _In_opt_ ULONG CreateOptions,
                        _In_opt_ PUNICODE_STRING Description);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenResourceManager(_Out_ PHANDLE ResourceManagerHandle,
                      _In_ ACCESS_MASK DesiredAccess, _In_ HANDLE TmHandle,
                      _In_opt_ LPGUID ResourceManagerGuid,
                      _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRecoverResourceManager(_In_ HANDLE ResourceManagerHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtGetNotificationResourceManager(
    _In_ HANDLE ResourceManagerHandle,
    _Out_ PTRANSACTION_NOTIFICATION TransactionNotification,
    _In_ ULONG NotificationLength, _In_opt_ PLARGE_INTEGER Timeout,
    _Out_opt_ PULONG ReturnLength, _In_ ULONG Asynchronous,
    _In_opt_ ULONG_PTR AsynchronousContext);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationResourceManager(
    _In_ HANDLE ResourceManagerHandle,
    _In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass,
    _Out_ PVOID ResourceManagerInformation,
    _In_ ULONG ResourceManagerInformationLength, _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationResourceManager(_In_ HANDLE ResourceManagerHandle,
                                _In_ RESOURCEMANAGER_INFORMATION_CLASS
                                    ResourceManagerInformationClass,
                                _In_ PVOID ResourceManagerInformation,
                                _In_ ULONG ResourceManagerInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtRegisterProtocolAddressInformation(_In_ HANDLE ResourceManager,
                                     _In_ PCRM_PROTOCOL_ID ProtocolId,
                                     _In_ ULONG ProtocolInformationSize,
                                     _In_ PVOID ProtocolInformation,
                                     _In_opt_ ULONG CreateOptions);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPropagationComplete(_In_ HANDLE ResourceManagerHandle,
                      _In_ ULONG RequestCookie, _In_ ULONG BufferLength,
                      _In_ PVOID Buffer);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtPropagationFailed(_In_ HANDLE ResourceManagerHandle, _In_ ULONG RequestCookie,
                    _In_ NTSTATUS PropStatus);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtFreezeTransactions(_In_ PLARGE_INTEGER FreezeTimeout,
                     _In_ PLARGE_INTEGER ThawTimeout);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtThawTransactions();
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateWorkerFactory(
    _Out_ PHANDLE WorkerFactoryHandleReturn, _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
    _In_ HANDLE CompletionPortHandle, _In_ HANDLE WorkerProcessHandle,
    _In_ PUSER_THREAD_START_ROUTINE StartRoutine, _In_opt_ PVOID StartParameter,
    _In_opt_ ULONG MaxThreadCount, _In_opt_ SIZE_T StackReserve,
    _In_opt_ SIZE_T StackCommit);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryInformationWorkerFactory(
    _In_ HANDLE WorkerFactoryHandle,
    _In_ WORKERFACTORYINFOCLASS WorkerFactoryInformationClass,
    _Out_ PVOID WorkerFactoryInformation,
    _In_ ULONG WorkerFactoryInformationLength, _Out_opt_ PULONG ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetInformationWorkerFactory(_In_ HANDLE WorkerFactoryHandle,
                              _In_ WORKERFACTORYINFOCLASS
                                  WorkerFactoryInformationClass,
                              _In_ PVOID WorkerFactoryInformation,
                              _In_ ULONG WorkerFactoryInformationLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtShutdownWorkerFactory(_In_ HANDLE WorkerFactoryHandle,
                        _Inout_ volatile LONG* PendingWorkerCount);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtReleaseWorkerFactoryWorker(_In_ HANDLE WorkerFactoryHandle);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtWorkerFactoryWorkerReady(_In_ HANDLE WorkerFactoryHandle);
#endif

#if NTDDI_VERSION >= NTDDI_VISTA
#if NTDDI_VERSION >= NTDDI_WIN8 || defined(_WIN64)
// Windows 8+ declaration, but can be used on any x64 Windows Vista+
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForWorkViaWorkerFactory(
    _In_ HANDLE WorkerFactoryHandle,
    _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket, _In_ ULONG Count,
    _Out_ PULONG NumEntriesRemoved,
    _In_ PLARGE_INTEGER Unknown  // Wrong type (but works)
);
#else
// Windows Vista/7 x86
NTSYSCALLAPI
NTSTATUS
NTAPI
NtWaitForWorkViaWorkerFactory(_In_ HANDLE WorkerFactoryHandle,
                              _Out_ PFILE_IO_COMPLETION_INFORMATION MiniPacket);
#endif
#endif

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemEnvironmentValue(_In_ PUNICODE_STRING VariableName,
                              _Out_ PWSTR VariableValue,
                              _In_ USHORT ValueLength,
                              _Out_opt_ PUSHORT ReturnLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemEnvironmentValue(_In_ PUNICODE_STRING VariableName,
                            _In_ PUNICODE_STRING VariableValue);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemEnvironmentValueEx(_In_ PUNICODE_STRING VariableName,
                                _In_ LPGUID VendorGuid, _Out_ PVOID Value,
                                _Inout_ PULONG ValueLength,
                                _Out_opt_ PULONG Attributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetSystemEnvironmentValueEx(_In_ PUNICODE_STRING VariableName,
                              _In_ LPGUID VendorGuid, _In_ PVOID Value,
                              _In_ ULONG ValueLength, _In_ ULONG Attributes);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateSystemEnvironmentValuesEx(_In_ ULONG InformationClass,
                                     _Out_ PVOID Buffer,
                                     _Inout_ PULONG BufferLength);

#if NTDDI_VERSION >= NTDDI_VISTA

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddBootEntry(_In_ PBOOT_ENTRY BootEntry, _Out_opt_ PULONG Id);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteBootEntry(_In_ ULONG Id);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtModifyBootEntry(_In_ PBOOT_ENTRY BootEntry);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateBootEntries(_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
                       _Inout_ PULONG BufferLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryBootEntryOrder(_Out_writes_opt_(*Count) PULONG Ids,
                      _Inout_ PULONG Count);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetBootEntryOrder(_In_reads_(Count) PULONG Ids, _In_ ULONG Count);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryBootOptions(_Out_writes_bytes_opt_(*BootOptionsLength)
                       PBOOT_OPTIONS BootOptions,
                   _Inout_ PULONG BootOptionsLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetBootOptions(_In_ PBOOT_OPTIONS BootOptions, _In_ ULONG FieldsToChange);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtTranslateFilePath(_In_ PFILE_PATH InputFilePath, _In_ ULONG OutputType,
                    _Out_writes_bytes_opt_(*OutputFilePathLength)
                        PFILE_PATH OutputFilePath,
                    _Inout_opt_ PULONG OutputFilePathLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddDriverEntry(_In_ PEFI_DRIVER_ENTRY DriverEntry, _Out_opt_ PULONG Id);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDeleteDriverEntry(_In_ ULONG Id);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtModifyDriverEntry(_In_ PEFI_DRIVER_ENTRY DriverEntry);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnumerateDriverEntries(_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
                         _Inout_ PULONG BufferLength);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryDriverEntryOrder(_Out_writes_opt_(*Count) PULONG Ids,
                        _Inout_ PULONG Count);

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSetDriverEntryOrder(_In_reads_(Count) PULONG Ids, _In_ ULONG Count);

#endif

#if NTDDI_VERSION >= NTDDI_WIN7

NTSYSCALLAPI
NTSTATUS
NTAPI
NtSerializeBoot();

NTSYSCALLAPI
NTSTATUS
NTAPI
NtEnableLastKnownGood();

NTSYSCALLAPI
NTSTATUS
NTAPI
NtDisableLastKnownGood();

#endif

NTSYSAPI
ULONG
__cdecl DbgPrint(_In_ PCH Format, ...);

NTSYSAPI
ULONG
__cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_ PCSTR Format,
                   ...);

NTSYSAPI
VOID NTAPI DbgBreakPoint();

NTSYSAPI
NTSTATUS
NTAPI
DbgUiConnectToDbg();

NTSYSAPI
HANDLE
NTAPI
DbgUiGetThreadDebugObject();

NTSYSAPI
VOID NTAPI DbgUiSetThreadDebugObject(_In_ HANDLE DebugObject);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiWaitStateChange(_Out_ PDBGUI_WAIT_STATE_CHANGE StateChange,
                     _In_opt_ PLARGE_INTEGER Timeout);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiContinue(_In_ PCLIENT_ID AppClientId, _In_ NTSTATUS ContinueStatus);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiStopDebugging(_In_ HANDLE Process);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiDebugActiveProcess(_In_ HANDLE Process);

NTSYSAPI
VOID NTAPI DbgUiRemoteBreakin(_In_ PVOID Context);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiIssueRemoteBreakin(_In_ HANDLE Process);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiConvertStateChangeStructure(_In_ PDBGUI_WAIT_STATE_CHANGE StateChange,
                                 _Out_ DEBUG_EVENT* DebugEvent);

NTSYSAPI
NTSTATUS
NTAPI
LdrLoadDll(_In_opt_ PCWSTR DllPath, _In_opt_ PULONG DllCharacteristics,
           _In_ PUNICODE_STRING DllName, _Out_ PVOID* DllHandle);

NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllHandle(_In_opt_ PCWSTR DllPath, _In_opt_ PULONG DllCharacteristics,
                _In_ PUNICODE_STRING DllName, _Out_ PVOID* DllHandle);

NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllHandleEx(_In_ ULONG Flags, _In_opt_ PCWSTR DllPath,
                  _In_opt_ PULONG DllCharacteristics,
                  _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID* DllHandle);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllHandleByMapping(_In_ PVOID Base, _Out_ PVOID* DllHandle);

NTSYSAPI
NTSTATUS
NTAPI
LdrGetDllHandleByName(_In_opt_ PUNICODE_STRING BaseDllName,
                      _In_opt_ PUNICODE_STRING FullDllName,
                      _Out_ PVOID* DllHandle);
#endif

NTSYSAPI
NTSTATUS
NTAPI
LdrGetProcedureAddress(_In_ PVOID DllHandle,
                       _In_opt_ CONST PANSI_STRING ProcedureName,
                       _In_opt_ ULONG ProcedureNumber,
                       _Out_ PVOID* ProcedureAddress);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
LdrGetProcedureAddressEx(_In_ PVOID DllHandle,
                         _In_opt_ PANSI_STRING ProcedureName,
                         _In_opt_ ULONG ProcedureNumber,
                         _Out_ PVOID* ProcedureAddress, _In_ ULONG Flags);
#endif

NTSYSAPI
NTSTATUS
NTAPI
LdrLockLoaderLock(_In_ ULONG Flags, _Out_opt_ ULONG* Disposition,
                  _Out_ PVOID* Cookie);

NTSYSAPI
NTSTATUS
NTAPI
LdrUnlockLoaderLock(_In_ ULONG Flags, _Inout_ PVOID Cookie);

NTSYSAPI
PIMAGE_BASE_RELOCATION
NTAPI
LdrProcessRelocationBlock(_In_ ULONG_PTR VA, _In_ ULONG SizeOfBlock,
                          _In_ PUSHORT NextOffset, _In_ LONG_PTR Diff);

NTSYSAPI
NTSTATUS
NTAPI
LdrUnloadDll(_In_ PVOID DllHandle);

NTSYSAPI
NTSTATUS
NTAPI
LdrDisableThreadCalloutsForDll(_In_ PVOID DllHandle);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
NTSTATUS
NTAPI
LdrOpenImageFileOptionsKey(_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64,
                           _Out_ PHANDLE NewKeyHandle);

NTSYSAPI
NTSTATUS
NTAPI
LdrQueryImageFileKeyOption(_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName,
                           _In_ ULONG Type, _Out_ PVOID Buffer,
                           _In_ ULONG BufferSize,
                           _Out_opt_ PULONG ReturnedLength);
#endif

NTSYSAPI
NTSTATUS
NTAPI
LdrVerifyImageMatchesChecksum(
    _In_ HANDLE ImageFileHandle,
    _In_opt_ PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine,
    _In_ PVOID ImportCallbackParameter, _Out_opt_ PUSHORT ImageCharacteristics);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
LdrVerifyImageMatchesChecksumEx(_In_ HANDLE ImageFileHandle,
                                _Inout_ PLDR_VERIFY_IMAGE_INFO VerifyInfo);
#endif

NTSYSAPI
NTSTATUS
NTAPI
LdrFindResourceDirectory_U(_In_ PVOID DllHandle,
                           _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
                           _In_ ULONG ResourceIdPathLength,
                           _Out_ PIMAGE_RESOURCE_DIRECTORY* ResourceDirectory);

NTSYSAPI
NTSTATUS
NTAPI
LdrFindResource_U(_In_ PVOID DllHandle,
                  _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
                  _In_ ULONG ResourceIdPathLength,
                  _Out_ PIMAGE_RESOURCE_DATA_ENTRY* ResourceDataEntry);

NTSYSAPI
NTSTATUS
NTAPI
LdrFindResourceEx_U(_In_opt_ ULONG Flags, _In_ PVOID DllHandle,
                    _In_ CONST LDR_RESOURCE_INFO* ResourceIdPath,
                    _In_ ULONG ResourceIdPathLength,
                    _Out_ PIMAGE_RESOURCE_DATA_ENTRY* ResourceDataEntry);

NTSYSAPI
VOID NTAPI RtlAssert(_In_ PVOID VoidFailedAssertion, _In_ PVOID VoidFileName,
                     _In_ ULONG LineNumber, _In_opt_ PSTR MutableMessage);

NTSYSAPI
DECLSPEC_NORETURN
VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status);

NTSYSAPI
VOID NTAPI RtlRaiseException(_In_ PEXCEPTION_RECORD ExceptionRecord);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlConnectToSm(_In_ PUNICODE_STRING ApiPortName, _In_ HANDLE ApiPortHandle,
               _In_ DWORD ProcessImageType, _Out_ PHANDLE SmssConnection);

NTSYSAPI
NTSTATUS
NTAPI
RtlSendMsgToSm(_In_ HANDLE ApiPortHandle, _In_ PPORT_MESSAGE MessageData);

NTSYSAPI
NTSTATUS
NTAPI
RtlRegisterThreadWithCsrss();
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlEnterCriticalSection(_Inout_ PRTL_CRITICAL_SECTION CriticalSection);

NTSYSAPI
NTSTATUS
NTAPI
RtlLeaveCriticalSection(_Inout_ PRTL_CRITICAL_SECTION CriticalSection);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
LOGICAL
NTAPI
RtlIsCriticalSectionLocked(_In_ PRTL_CRITICAL_SECTION CriticalSection);

NTSYSAPI
LOGICAL
NTAPI
RtlIsCriticalSectionLockedByThread(_In_ PRTL_CRITICAL_SECTION CriticalSection);

NTSYSAPI
ULONG
NTAPI
RtlGetCriticalSectionRecursionCount(_In_ PRTL_CRITICAL_SECTION CriticalSection);
#endif

NTSYSAPI
LOGICAL
NTAPI
RtlTryEnterCriticalSection(_Inout_ PRTL_CRITICAL_SECTION CriticalSection);

NTSYSAPI
NTSTATUS
NTAPI
RtlInitializeCriticalSection(_Out_ PRTL_CRITICAL_SECTION CriticalSection);

NTSYSAPI
VOID NTAPI RtlEnableEarlyCriticalSectionEventCreation();

NTSYSAPI
NTSTATUS
NTAPI
RtlInitializeCriticalSectionAndSpinCount(
    _Out_ PRTL_CRITICAL_SECTION CriticalSection, _In_ ULONG SpinCount);

NTSYSAPI
ULONG
NTAPI
RtlSetCriticalSectionSpinCount(_Inout_ PRTL_CRITICAL_SECTION CriticalSection,
                               _In_ ULONG SpinCount);

NTSYSAPI
NTSTATUS
NTAPI
RtlDeleteCriticalSection(_Inout_ PRTL_CRITICAL_SECTION CriticalSection);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
BOOL NTAPI RtlQueryPerformanceFrequency(_Out_ PLARGE_INTEGER Frequency);
#else
FORCEINLINE
BOOL NTAPI RtlQueryPerformanceFrequency(_Out_ PLARGE_INTEGER Frequency) {
  LARGE_INTEGER _;
  return NT_SUCCESS(NtQueryPerformanceCounter(&_, Frequency));
}
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
BOOL NTAPI RtlQueryPerformanceCounter(_Out_ PLARGE_INTEGER PerformanceCount);
#else
FORCEINLINE
BOOL NTAPI RtlQueryPerformanceCounter(_Out_ PLARGE_INTEGER PerformanceCount) {
  return NT_SUCCESS(NtQueryPerformanceCounter(PerformanceCount, NULL));
}
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlGetCompressionWorkSpaceSize(_In_ USHORT CompressionFormatAndEngine,
                               _Out_ PULONG CompressBufferWorkSpaceSize,
                               _Out_ PULONG CompressFragmentWorkSpaceSize);

NTSYSAPI
NTSTATUS
NTAPI
RtlCompressBuffer(_In_ USHORT CompressionFormatAndEngine,
                  _In_ PUCHAR UncompressedBuffer,
                  _In_ ULONG UncompressedBufferSize,
                  _Out_ PUCHAR CompressedBuffer,
                  _In_ ULONG CompressedBufferSize,
                  _In_ ULONG UncompressedChunkSize,
                  _Out_ PULONG FinalCompressedSize, _In_ PVOID WorkSpace);

NTSYSAPI
NTSTATUS
NTAPI
RtlDecompressBuffer(_In_ USHORT CompressionFormat,
                    _Out_ PUCHAR UncompressedBuffer,
                    _In_ ULONG UncompressedBufferSize,
                    _In_ PUCHAR CompressedBuffer,
                    _In_ ULONG CompressedBufferSize,
                    _Out_ PULONG FinalUncompressedSize);

NTSYSAPI
PVOID
NTAPI
RtlCreateHeap(_In_ ULONG Flags, _In_opt_ PVOID HeapBase,
              _In_opt_ SIZE_T ReserveSize, _In_opt_ SIZE_T CommitSize,
              _In_opt_ PVOID Lock, _In_opt_ PRTL_HEAP_PARAMETERS Parameters);

NTSYSAPI
PVOID
NTAPI
RtlDestroyHeap(_Inout_ PVOID HeapHandle);

NTSYSAPI
PVOID
NTAPI
RtlAllocateHeap(_In_ PVOID HeapHandle, _In_opt_ ULONG Flags, _In_ SIZE_T Size);

NTSYSAPI
BOOLEAN
NTAPI
RtlFreeHeap(_In_ PVOID HeapHandle, _In_opt_ ULONG Flags,
            _Inout_opt_ PVOID BaseAddress);

NTSYSAPI
NTSTATUS
NTAPI
RtlWalkHeap(_In_ PVOID HeapHandle, _Inout_ PRTL_HEAP_WALK_ENTRY Entry);

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryHeapInformation(_In_ PVOID HeapHandle,
                        _In_ HEAP_INFORMATION_CLASS HeapInformationClass,
                        _Out_opt_ PVOID HeapInformation,
                        _In_opt_ SIZE_T HeapInformationLength,
                        _Out_opt_ PSIZE_T ReturnLength);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetHeapInformation(_In_ PVOID HeapHandle,
                      _In_ HEAP_INFORMATION_CLASS HeapInformationClass,
                      _In_opt_ PVOID HeapInformation,
                      _In_opt_ SIZE_T HeapInformationLength);

NTSYSAPI
SIZE_T
NTAPI
RtlSizeHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags, _In_ PVOID BaseAddress);

NTSYSAPI
NTSTATUS
NTAPI
RtlZeroHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags);

NTSYSAPI
VOID NTAPI RtlProtectHeap(_In_ PVOID HeapHandle, _In_ BOOLEAN MakeReadOnly);

NTSYSAPI
BOOLEAN
NTAPI
RtlLockHeap(_In_ PVOID HeapHandle);

NTSYSAPI
BOOLEAN
NTAPI
RtlUnlockHeap(_In_ PVOID HeapHandle);

NTSYSAPI
PVOID
NTAPI
RtlReAllocateHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                  _Inout_opt_ PVOID BaseAddress, _In_ SIZE_T Size);

NTSYSAPI
BOOLEAN
NTAPI
RtlGetUserInfoHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                   _In_ PVOID BaseAddress, _Out_opt_ PVOID* UserValue,
                   _Out_opt_ PULONG UserFlags);

NTSYSAPI
BOOLEAN
NTAPI
RtlSetUserValueHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                    _In_ PVOID BaseAddress, _In_ PVOID UserValue);

NTSYSAPI
BOOLEAN
NTAPI
RtlSetUserFlagsHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                    _In_ PVOID BaseAddress, _In_ ULONG UserFlagsReset,
                    _In_ ULONG UserFlagsSet);

NTSYSAPI
ULONG
NTAPI
RtlCreateTagHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                 _In_opt_ PWSTR TagPrefix, _In_ PWSTR TagNames);

NTSYSAPI
PWSTR
NTAPI
RtlQueryTagHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags, _In_ USHORT TagIndex,
                _In_ BOOLEAN ResetCounters,
                _Out_opt_ PRTL_HEAP_TAG_INFO TagInfo);

NTSYSAPI
SIZE_T
NTAPI
RtlCompactHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags);

NTSYSAPI
BOOLEAN
NTAPI
RtlValidateHeap(_In_ PVOID HeapHandle, _In_ ULONG Flags,
                _In_ PVOID BaseAddress);

NTSYSAPI
BOOLEAN
NTAPI
RtlValidateProcessHeaps();

NTSYSAPI
ULONG
NTAPI
RtlGetProcessHeaps(_In_ ULONG NumberOfHeaps, _Out_ PVOID* ProcessHeaps);

NTSYSAPI
NTSTATUS
NTAPI
RtlEnumProcessHeaps(_In_ PRTL_ENUM_HEAPS_ROUTINE EnumRoutine,
                    _In_ PVOID Parameter);

NTSYSAPI
ULONG
NTAPI
RtlUniform(_Inout_ PULONG Seed);

NTSYSAPI
ULONG
NTAPI
RtlRandom(_Inout_ PULONG Seed);

NTSYSAPI
ULONG
NTAPI
RtlRandomEx(_Inout_ PULONG Seed);

NTSYSAPI
NTSTATUS
NTAPI
RtlFindMessage(_In_ PVOID DllHandle, _In_ ULONG MessageTableId,
               _In_ ULONG MessageLanguageId, _In_ ULONG MessageId,
               _Out_ PMESSAGE_RESOURCE_ENTRY* MessageEntry);

NTSYSAPI
NTSTATUS
NTAPI
RtlFormatMessage(_In_ PCWSTR MessageFormat, _In_ ULONG MaximumWidth,
                 _In_ BOOLEAN IgnoreInserts, _In_ BOOLEAN ArgumentsAreAnsi,
                 _In_ BOOLEAN ArgumentsAreAnArray, _In_ va_list* Arguments,
                 _Out_ PWSTR Buffer, _In_ ULONG Length,
                 _Out_opt_ PULONG ReturnLength);

NTSYSAPI
ULONG
NTAPI
RtlNtStatusToDosError(_In_ NTSTATUS Status);

NTSYSAPI
ULONG
NTAPI
RtlNtStatusToDosErrorNoTeb(_In_ NTSTATUS Status);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetLastNtStatus();

NTSYSAPI
LONG NTAPI RtlGetLastWin32Error();

NTSYSAPI
VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus(_In_ NTSTATUS Status);

NTSYSAPI
VOID NTAPI RtlSetLastWin32Error(_In_ LONG Win32Error);

NTSYSAPI
VOID NTAPI RtlRestoreLastWin32Error(_In_ LONG Win32Error);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
ULONG
NTAPI
RtlGetThreadErrorMode();

NTSYSAPI
NTSTATUS
NTAPI
RtlSetThreadErrorMode(_In_ ULONG NewMode, _Out_opt_ PULONG OldMode);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlUpcaseUnicodeString(_Out_ PUNICODE_STRING DestinationString,
                       _In_ PCUNICODE_STRING SourceString,
                       _In_ BOOLEAN AllocateDestinationString);

NTSYSAPI
VOID NTAPI RtlInitUnicodeString(_Out_ PUNICODE_STRING DestinationString,
                                _In_opt_ PWSTR SourceString);

NTSYSAPI
VOID NTAPI RtlInitAnsiString(_Out_ PANSI_STRING DestinationString,
                             _In_opt_ PSTR SourceString);

NTSYSAPI
VOID NTAPI RtlCopyUnicodeString(_Out_ PUNICODE_STRING DestinationString,
                                _In_ PCUNICODE_STRING SourceString);

NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeToString(_In_ PUNICODE_STRING Destination,
                         _In_opt_ PCWSTR Source);

NTSYSAPI
NTSTATUS
NTAPI
RtlAnsiStringToUnicodeString(_Inout_ PUNICODE_STRING DestinationString,
                             _In_ PANSI_STRING SourceString,
                             _In_ BOOLEAN AllocateDestinationString);

NTSYSAPI
NTSTATUS
NTAPI
RtlUnicodeStringToAnsiString(_Inout_ PANSI_STRING DestinationString,
                             _In_ PUNICODE_STRING SourceString,
                             _In_ BOOLEAN AllocateDestinationString);

NTSYSAPI
VOID NTAPI RtlFreeAnsiString(_Inout_ PANSI_STRING AnsiString);

NTSYSAPI
NTSTATUS
NTAPI
RtlDefaultNpAcl(_Out_ PACL* Dacl);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateEnvironment(_In_ BOOLEAN CloneCurrentEnvironment,
                     _Out_ PVOID* Environment);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlCreateEnvironmentEx(_In_ PVOID SourceEnv, _Out_ PVOID* Environment,
                       _In_ ULONG Flags);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlDestroyEnvironment(_In_ PVOID Environment);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetCurrentEnvironment(_In_ PVOID Environment,
                         _Out_opt_ PVOID* PreviousEnvironment);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlSetEnvironmentVar(_In_opt_ PWSTR* Environment, _In_ PWSTR Name,
                     _In_ SIZE_T NameLength, _In_ PWSTR Value,
                     _In_ SIZE_T ValueLength);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlSetEnvironmentVariable(_In_opt_ PVOID* Environment,
                          _In_ PUNICODE_STRING Name,
                          _In_ PUNICODE_STRING Value);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlQueryEnvironmentVariable(_In_opt_ PVOID Environment, _In_ PWSTR Name,
                            _In_ SIZE_T NameLength, _Out_ PWSTR Value,
                            _In_ SIZE_T ValueLength,
                            _Out_ PSIZE_T ReturnLength);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryEnvironmentVariable_U(_In_opt_ PVOID Environment,
                              _In_ PUNICODE_STRING Name,
                              _Out_ PUNICODE_STRING Value);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlExpandEnvironmentStrings(_In_opt_ PVOID Environment, _In_ PWSTR Src,
                            _In_ SIZE_T SrcLength, _Out_ PWSTR Dst,
                            _In_ SIZE_T DstLength,
                            _Out_opt_ PSIZE_T ReturnLength);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlExpandEnvironmentStrings_U(_In_opt_ PVOID Environment,
                              _In_ PUNICODE_STRING Source,
                              _Out_ PUNICODE_STRING Destination,
                              _Out_opt_ PULONG ReturnedLength);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
NTSTATUS
NTAPI
RtlSetEnvironmentStrings(_In_ PWCHAR NewEnvironment,
                         _In_ SIZE_T NewEnvironmentSize);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateProcessParameters(
    _Out_ PRTL_USER_PROCESS_PARAMETERS* pProcessParameters,
    _In_ PUNICODE_STRING ImagePathName, _In_opt_ PUNICODE_STRING DllPath,
    _In_opt_ PUNICODE_STRING CurrentDirectory,
    _In_opt_ PUNICODE_STRING CommandLine, _In_opt_ PVOID Environment,
    _In_opt_ PUNICODE_STRING WindowTitle, _In_opt_ PUNICODE_STRING DesktopInfo,
    _In_opt_ PUNICODE_STRING ShellInfo, _In_opt_ PUNICODE_STRING RuntimeData);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
RtlCreateProcessParametersEx(
    _Out_ PRTL_USER_PROCESS_PARAMETERS* pProcessParameters,
    _In_ PUNICODE_STRING ImagePathName, _In_opt_ PUNICODE_STRING DllPath,
    _In_opt_ PUNICODE_STRING CurrentDirectory,
    _In_opt_ PUNICODE_STRING CommandLine, _In_opt_ PVOID Environment,
    _In_opt_ PUNICODE_STRING WindowTitle, _In_opt_ PUNICODE_STRING DesktopInfo,
    _In_opt_ PUNICODE_STRING ShellInfo, _In_opt_ PUNICODE_STRING RuntimeData,
    _In_ ULONG Flags  // Pass RTL_USER_PROCESS_PARAMETERS_NORMALIZED to keep
                      // parameters normalized
);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlDestroyProcessParameters(
    _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters);

NTSYSAPI
PRTL_USER_PROCESS_PARAMETERS
NTAPI
RtlNormalizeProcessParams(
    _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters);

NTSYSAPI
PRTL_USER_PROCESS_PARAMETERS
NTAPI
RtlDeNormalizeProcessParams(
    _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateUserProcess(_In_ PUNICODE_STRING NtImagePathName,
                     _In_ ULONG AttributesDeprecated,
                     _In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
                     _In_opt_ PSECURITY_DESCRIPTOR ProcessSecurityDescriptor,
                     _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
                     _In_opt_ HANDLE ParentProcess, _In_ BOOLEAN InheritHandles,
                     _In_opt_ HANDLE DebugPort,
                     _In_opt_ HANDLE TokenHandle,  // used to be ExceptionPort
                     _Out_ PRTL_USER_PROCESS_INFORMATION ProcessInformation);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateUserThread(_In_ HANDLE Process,
                    _In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
                    _In_ BOOLEAN CreateSuspended, _In_opt_ ULONG ZeroBits,
                    _In_opt_ SIZE_T MaximumStackSize,
                    _In_opt_ SIZE_T CommittedStackSize,
                    _In_ PUSER_THREAD_START_ROUTINE StartAddress,
                    _In_opt_ PVOID Parameter, _Out_opt_ PHANDLE Thread,
                    _Out_opt_ PCLIENT_ID ClientId);

NTSYSAPI
NTSTATUS
NTAPI
RtlDosApplyFileIsolationRedirection_Ustr(
    _In_ ULONG Flags, _In_ PUNICODE_STRING OriginalName,
    _In_ PUNICODE_STRING Extension, _Inout_ PUNICODE_STRING StaticString,
    _Inout_ PUNICODE_STRING DynamicString, _Inout_ PUNICODE_STRING* NewName,
    _In_ PULONG NewFlags, _In_ PSIZE_T FileNameSize,
    _In_ PSIZE_T RequiredLength);

NTSYSAPI
PIMAGE_NT_HEADERS
NTAPI
RtlImageNtHeader(_In_ PVOID ImageBase);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
NTSTATUS
NTAPI
RtlImageNtHeaderEx(_In_opt_ ULONG Flags, _In_ PVOID Base, _In_ ULONG64 Size,
                   _Out_ PIMAGE_NT_HEADERS* OutHeaders);
#endif

NTSYSAPI
PVOID
NTAPI
RtlImageDirectoryEntryToData(_In_ PVOID ImageBase, _In_ BOOLEAN MappedAsImage,
                             _In_ USHORT DirectoryEntry, _Out_ PULONG Size);

NTSYSAPI
PVOID
NTAPI
RtlPcToFileHeader(_In_ PVOID PcValue, _Out_ PVOID* BaseOfImage);

NTSYSAPI
PVOID
NTAPI
RtlAddressInSectionTable(_In_ PIMAGE_NT_HEADERS NtHeaders,
                         _In_ PVOID BaseOfImage, _In_ ULONG VirtualAddress);

NTSYSAPI
PIMAGE_SECTION_HEADER
NTAPI
RtlImageRvaToSection(_In_ PIMAGE_NT_HEADERS NtHeaders, _In_ PVOID Base,
                     _In_ ULONG Rva);

NTSYSAPI
PVOID
NTAPI
RtlImageRvaToVa(_In_ PIMAGE_NT_HEADERS NtHeaders, _In_ PVOID Base,
                _In_ ULONG Rva,
                _Inout_opt_ PIMAGE_SECTION_HEADER* LastRvaSection);

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryProcessHeapInformation(_Inout_ PRTL_DEBUG_INFORMATION Buffer);

NTSYSAPI
PRTL_DEBUG_INFORMATION
NTAPI
RtlCreateQueryDebugBuffer(_In_opt_ ULONG MaximumCommit,
                          _In_ BOOLEAN UseEventPair);

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryProcessDebugInformation(_In_ HANDLE UniqueProcessId, _In_ ULONG Flags,
                                _Inout_ PRTL_DEBUG_INFORMATION Buffer);

#ifdef _WIN64
NTSYSAPI
VOID WINAPI RtlRestoreContext(_In_ PCONTEXT ContextRecord,
                              _In_opt_ PEXCEPTION_RECORD ExceptionRecord);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlAdjustPrivilege(_In_ ULONG Privilege, _In_ BOOLEAN Enable,
                   _In_ BOOLEAN Client, _Out_ PBOOLEAN WasEnabled);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
NTSTATUS
NTAPI
RtlAcquirePrivilege(_In_ PULONG Privilege, _In_ ULONG NumPriv, _In_ ULONG Flags,
                    _Out_ PVOID* ReturnedState);

NTSYSAPI
VOID NTAPI RtlReleasePrivilege(_In_ PVOID StatePointer);
#endif

NTSYSAPI
ULONG
NTAPI
RtlGetFullPathName_U(_In_ PWSTR FileName, _In_ ULONG BufferLength,
                     _Out_ PWSTR Buffer, _Out_opt_ PWSTR* FilePart);

NTSYSAPI
BOOLEAN
NTAPI
RtlDosPathNameToNtPathName_U(_In_ PCWSTR DosFileName,
                             _Out_ PUNICODE_STRING NtFileName,
                             _Out_opt_ PWSTR* FilePart,
                             _Reserved_ PVOID Reserved);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
BOOLEAN
NTAPI
RtlDosPathNameToRelativeNtPathName_U(
    _In_ PCWSTR DosFileName, _Out_ PUNICODE_STRING NtFileName,
    _Out_opt_ PWSTR* FilePart, _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName);

NTSYSAPI
NTSTATUS
NTAPI
RtlDosPathNameToRelativeNtPathName_U_WithStatus(
    _In_ PWSTR DosFileName, _Out_ PUNICODE_STRING NtFileName,
    _Out_opt_ PWSTR* FilePart, _Out_opt_ PRTL_RELATIVE_NAME_U RelativeName);
#endif

NTSYSAPI
RTL_PATH_TYPE
NTAPI
RtlDetermineDosPathNameType_U(_In_ PCWSTR Path);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
NTSTATUS
NTAPI
RtlGetFullPathName_UstrEx(_In_ PUNICODE_STRING FileName,
                          _In_opt_ PUNICODE_STRING StaticString,
                          _In_opt_ PUNICODE_STRING DynamicString,
                          _Out_opt_ PUNICODE_STRING* StringUsed,
                          _Out_opt_ PSIZE_T FilePartSize,
                          _Out_opt_ PBOOLEAN NameInvalid,
                          _Out_ RTL_PATH_TYPE* PathType,
                          _Out_opt_ PSIZE_T LengthNeeded);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlSetCurrentDirectory_U(_In_ PUNICODE_STRING PathName);

#if NTDDI_VERSION >= NTDDI_WS03
NTSYSAPI
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName);
#endif

NTSYSAPI
NTSTATUS
NTAPI
RtlNtPathNameToDosPathName(_In_ ULONG Flags,
                           _Inout_ PRTL_UNICODE_STRING_BUFFER Path,
                           _Out_opt_ PULONG Disposition,
                           _Inout_opt_ PWSTR* FilePart);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
VOID NTAPI RtlInitializeSRWLock(_Out_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
VOID NTAPI RtlAcquireSRWLockExclusive(_Inout_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
VOID NTAPI RtlAcquireSRWLockShared(_Inout_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
VOID NTAPI RtlReleaseSRWLockExclusive(_Inout_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
VOID NTAPI RtlReleaseSRWLockShared(_Inout_ PRTL_SRWLOCK SRWLock);
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
BOOLEAN
NTAPI
RtlTryAcquireSRWLockExclusive(_Inout_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
BOOLEAN
NTAPI
RtlTryAcquireSRWLockShared(_Inout_ PRTL_SRWLOCK SRWLock);

NTSYSAPI
VOID NTAPI RtlAcquireReleaseSRWLockExclusive(_Inout_ PRTL_SRWLOCK SRWLock);
#endif

NTSYSAPI
ULONG
NTAPI
RtlWalkFrameChain(_Out_ PVOID* Callers, _In_ ULONG Count, _In_ ULONG Flags);

NTSYSAPI
PPREFIX_TABLE_ENTRY
NTAPI
PfxFindPrefix(_In_ PPREFIX_TABLE PrefixTable, _In_ PANSI_STRING FullName);

NTSYSAPI
VOID NTAPI PfxInitialize(_Out_ PPREFIX_TABLE PrefixTable);

NTSYSAPI
BOOLEAN
NTAPI
PfxInsertPrefix(_In_ PPREFIX_TABLE PrefixTable, _In_ PANSI_STRING Prefix,
                _Out_ PPREFIX_TABLE_ENTRY PrefixTableEntry);

NTSYSAPI
VOID NTAPI PfxRemovePrefix(_In_ PPREFIX_TABLE PrefixTable,
                           _In_ PPREFIX_TABLE_ENTRY PrefixTableEntry);

NTSYSAPI
NTSTATUS
NTAPI
RtlAbsoluteToSelfRelativeSD(
    _In_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
    _Out_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
    _Inout_ PULONG BufferLength);

NTSYSAPI
NTSTATUS
NTAPI
RtlAddAccessAllowedAce(_Inout_ PACL Acl, _In_ ULONG AceRevision,
                       _In_ ACCESS_MASK AccessMask, _In_ PSID Sid);

NTSYSAPI
NTSTATUS
NTAPI
RtlAddAccessAllowedAceEx(_Inout_ PACL Acl, _In_ ULONG AceRevision,
                         _In_ ULONG AceFlags, _In_ ACCESS_MASK AccessMask,
                         _In_ PSID Sid);

NTSYSAPI
NTSTATUS
NTAPI
RtlAddAce(_Inout_ PACL Acl, _In_ ULONG AceRevision, _In_ ULONG StartingAceIndex,
          _In_ PVOID AceList, _In_ ULONG AceListLength);

NTSYSAPI
NTSTATUS
NTAPI
RtlAddAtomToAtomTable(_In_ PVOID AtomTableHandle, _In_ PWSTR AtomName,
                      _Inout_opt_ PRTL_ATOM Atom);

NTSYSAPI
NTSTATUS
NTAPI
RtlAppendUnicodeStringToString(PUNICODE_STRING Destination,
                               PCUNICODE_STRING Source);

NTSYSAPI
BOOLEAN
NTAPI
RtlAreAllAccessesGranted(_In_ ACCESS_MASK GrantedAccess,
                         _In_ ACCESS_MASK DesiredAccess);

NTSYSAPI
BOOLEAN
NTAPI
RtlAreAnyAccessesGranted(_In_ ACCESS_MASK GrantedAccess,
                         _In_ ACCESS_MASK DesiredAccess);

NTSYSAPI
BOOLEAN
NTAPI
RtlAreBitsClear(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG StartingIndex,
                _In_ ULONG Length);

NTSYSAPI
BOOLEAN
NTAPI
RtlAreBitsSet(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG StartingIndex,
              _In_ ULONG Length);

NTSYSAPI
VOID NTAPI RtlCaptureContext(_Out_ PCONTEXT ContextRecord);

NTSYSAPI
USHORT
NTAPI
RtlCaptureStackBackTrace(_In_ ULONG FramesToSkip, _In_ ULONG FramesToCapture,
                         _Out_ PVOID* BackTrace,
                         _Out_opt_ PULONG BackTraceHash);

NTSYSAPI
VOID NTAPI RtlClearAllBits(_In_ PRTL_BITMAP BitMapHeader);

NTSYSAPI
VOID NTAPI RtlClearBits(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG StartingIndex,
                        _In_ ULONG NumberToClear);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateSystemVolumeInformationFolder(_In_ PCUNICODE_STRING VolumeRootPath);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
LONG NTAPI RtlCompareAltitudes(_In_ PCUNICODE_STRING Altitude1,
                               _In_ PCUNICODE_STRING Altitude2);
#endif

NTSYSAPI
LONG NTAPI RtlCompareUnicodeString(_In_ PCUNICODE_STRING String1,
                                   _In_ PCUNICODE_STRING String2,
                                   _In_ BOOLEAN CaseInSensitive);

NTSYSAPI
ULONG32
NTAPI
RtlComputeCrc32(_In_ ULONG32 PartialCrc, _In_ PVOID Buffer, _In_ ULONG Length);

NTSYSAPI
NTSTATUS
NTAPI
RtlConvertSidToUnicodeString(_Inout_ PUNICODE_STRING UnicodeString,
                             _In_ PSID Sid,
                             _In_ BOOLEAN AllocateDestinationString);

NTSYSAPI
VOID NTAPI RtlCopyLuid(_Out_ PLUID DestinationLuid, _In_ PLUID SourceLuid);

NTSYSAPI
NTSTATUS
NTAPI
RtlCopySid(_In_ ULONG DestinationSidLength, _Out_ PSID DestinationSid,
           _In_ PSID SourceSid);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateAcl(_Out_ PACL Acl, _In_ ULONG AclLength, _In_ ULONG AclRevision);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateAtomTable(_In_ ULONG NumberOfBuckets, _Out_ PVOID* AtomTableHandle);

NTSYSAPI
NTSTATUS
NTAPI
RtlDecompressFragment(_In_ USHORT CompressionFormat,
                      _Out_ PUCHAR UncompressedFragment,
                      _In_ ULONG UncompressedFragmentSize,
                      _In_ PUCHAR CompressedBuffer,
                      _In_ ULONG CompressedBufferSize,
                      _In_ ULONG FragmentOffset,
                      _Out_ PULONG FinalUncompressedSize, _In_ PVOID WorkSpace);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlDelete(_In_ PRTL_SPLAY_LINKS Links);

NTSYSAPI
NTSTATUS
NTAPI
RtlDeleteAce(_Inout_ PACL Acl, _In_ ULONG AceIndex);

NTSYSAPI
NTSTATUS
NTAPI
RtlDeleteAtomFromAtomTable(_In_ PVOID AtomTableHandle, _In_ RTL_ATOM Atom);

NTSYSAPI
VOID NTAPI RtlDeleteNoSplay(_In_ PRTL_SPLAY_LINKS Links,
                            _Inout_ PRTL_SPLAY_LINKS* Root);

NTSYSAPI
NTSTATUS
NTAPI
RtlDowncaseUnicodeString(_Out_ PUNICODE_STRING DestinationString,
                         _In_ PCUNICODE_STRING SourceString,
                         _In_ BOOLEAN AllocateDestinationString);

NTSYSAPI
NTSTATUS
NTAPI
RtlDuplicateUnicodeString(_In_ ULONG Flags, _In_ UNICODE_STRING* StringIn,
                          _Out_ UNICODE_STRING* StringOut);

NTSYSAPI
NTSTATUS
NTAPI
RtlEmptyAtomTable(_In_ PVOID AtomTableHandle, _In_ BOOLEAN IncludePinnedAtoms);

NTSYSAPI
BOOLEAN
NTAPI
RtlEqualSid(_In_ PSID Sid1, _In_ PSID Sid2);

NTSYSAPI
BOOLEAN
NTAPI
RtlEqualString(_In_ PANSI_STRING String1, _In_ PANSI_STRING String2,
               _In_ BOOLEAN CaseInSensitive);

NTSYSAPI
BOOLEAN
NTAPI
RtlEqualUnicodeString(_In_ PCUNICODE_STRING String1,
                      _In_ PCUNICODE_STRING String2,
                      _In_ BOOLEAN CaseInSensitive);

NTSYSAPI
ULONG
NTAPI
RtlFindClearBits(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG NumberToFind,
                 _In_ ULONG HintIndex);

NTSYSAPI
ULONG
NTAPI
RtlFindClearBitsAndSet(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG NumberToFind,
                       _In_ ULONG HintIndex);

NTSYSAPI
ULONG
NTAPI
RtlFindClearRuns(_In_ PRTL_BITMAP BitMapHeader, _Out_ PRTL_BITMAP_RUN RunArray,
                 _In_ ULONG SizeOfRunArray, _In_ BOOLEAN LocateLongestRuns);

NTSYSAPI
ULONG
NTAPI
RtlFindLastBackwardRunClear(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG FromIndex,
                            _In_ PULONG StartingRunIndex);

NTSYSAPI
CCHAR
NTAPI
RtlFindLeastSignificantBit(_In_ ULONGLONG Set);

NTSYSAPI
ULONG
NTAPI
RtlFindLongestRunClear(_In_ PRTL_BITMAP BitMapHeader,
                       _In_ PULONG StartingIndex);

NTSYSAPI
CCHAR
NTAPI
RtlFindMostSignificantBit(_In_ ULONGLONG Set);

NTSYSAPI
ULONG
NTAPI
RtlFindNextForwardRunClear(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG FromIndex,
                           _In_ PULONG StartingRunIndex);

NTSYSAPI
ULONG
NTAPI
RtlFindSetBits(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG NumberToFind,
               _In_ ULONG HintIndex);

NTSYSAPI
ULONG
NTAPI
RtlFindSetBitsAndClear(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG NumberToFind,
                       _In_ ULONG HintIndex);

NTSYSAPI
VOID NTAPI RtlGetCallersAddress(_Out_ PVOID* CallersAddress,
                                _Out_ PVOID* CallersCaller);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetDaclSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                             _Out_ PBOOLEAN DaclPresent, _Out_ PACL* Dacl,
                             _Out_ PBOOLEAN DaclDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetGroupSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                              _Out_ PSID* Group, _Out_ PBOOLEAN GroupDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetOwnerSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                              _Out_ PSID* Owner, _Out_ PBOOLEAN OwnerDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetSaclSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                             _Out_ PBOOLEAN SaclPresent, _Out_ PACL* Sacl,
                             _Out_ PBOOLEAN SaclDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlGetSetBootStatusData(_In_ HANDLE Handle, _In_ BOOLEAN Get,
                        _In_ RTL_BSD_ITEM_TYPE DataItem, _In_ PVOID DataBuffer,
                        _In_ ULONG DataBufferLength, _Out_opt_ PULONG ByteRead);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateBootStatusDataFile();

NTSYSAPI
NTSTATUS
NTAPI
RtlGetVersion(_Out_ PRTL_OSVERSIONINFOW lpVersionInformation);

NTSYSAPI
NTSTATUS
NTAPI
RtlGUIDFromString(_In_ PUNICODE_STRING GuidString, _Out_ GUID* Guid);

NTSYSAPI
NTSTATUS
NTAPI
RtlHashUnicodeString(_In_ UNICODE_STRING* String, _In_ BOOLEAN CaseInSensitive,
                     _In_ ULONG HashAlgorithm, _Out_ PULONG HashValue);

NTSYSAPI
NTSTATUS
NTAPI
RtlInitializeSid(_Out_ PSID Sid,
                 _In_ PSID_IDENTIFIER_AUTHORITY IdentifierAuthority,
                 _In_ UCHAR SubAuthorityCount);

NTSYSAPI
ULONG
NTAPI
RtlLengthRequiredSid(_In_ ULONG SubAuthorityCount);

NTSYSAPI
ULONG
NTAPI
RtlLengthSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor);

NTSYSAPI
ULONG
NTAPI
RtlLengthSid(_In_ PSID Sid);

NTSYSAPI
NTSTATUS
NTAPI
RtlLockBootStatusData(_Out_ PHANDLE BootStatusDataHandle);

NTSYSAPI
NTSTATUS
NTAPI
RtlLookupAtomInAtomTable(_In_ PVOID AtomTableHandle, _In_ PWSTR AtomName,
                         _Out_opt_ PRTL_ATOM Atom);

NTSYSAPI
NTSTATUS
NTAPI
RtlMapSecurityErrorToNtStatus(_In_ SECURITY_STATUS Error);

NTSYSAPI
NTSTATUS
NTAPI
RtlMultiByteToUnicodeN(_Out_ PWCH UnicodeString,
                       _In_ ULONG MaxBytesInUnicodeString,
                       _Out_opt_ PULONG BytesInUnicodeString,
                       _In_ PCSTR MultiByteString,
                       _In_ ULONG BytesInMultiByteString);

NTSYSAPI
NTSTATUS
NTAPI
RtlMultiByteToUnicodeSize(_Out_ PULONG BytesInUnicodeString,
                          _In_ PCSTR MultiByteString,
                          _In_ ULONG BytesInMultiByteString);

NTSYSAPI
ULONG
NTAPI
RtlNumberOfClearBits(_In_ PRTL_BITMAP BitMapHeader);

NTSYSAPI
ULONG
NTAPI
RtlNumberOfSetBits(_In_ PRTL_BITMAP BitMapHeader);

NTSYSAPI
NTSTATUS
NTAPI
RtlQueryAtomInAtomTable(_In_ PVOID AtomTableHandle, _In_ RTL_ATOM Atom,
                        _Out_opt_ PULONG AtomUsage, _Out_opt_ PULONG AtomFlags,
                        _Inout_opt_ PWSTR AtomName,
                        _Inout_opt_ PULONG AtomNameLength);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlRealPredecessor(_In_ PRTL_SPLAY_LINKS Links);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlRealSuccessor(_In_ PRTL_SPLAY_LINKS Links);

NTSYSAPI
VOID NTAPI RtlRunDecodeUnicodeString(_In_ UCHAR Seed,
                                     _Inout_ PUNICODE_STRING String);

NTSYSAPI
VOID NTAPI RtlRunEncodeUnicodeString(_In_opt_ PUCHAR Seed,
                                     _Inout_ PUNICODE_STRING String);

NTSYSAPI
NTSTATUS
NTAPI
RtlSelfRelativeToAbsoluteSD(
    _In_ PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor,
    _Out_ PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor,
    _Inout_ PULONG AbsoluteSecurityDescriptorSize, _Out_ PACL Dacl,
    _Inout_ PULONG DaclSize, _Out_ PACL Sacl, _Inout_ PULONG SaclSize,
    _Out_opt_ PSID Owner, _Inout_ PULONG OwnerSize, _Out_opt_ PSID PrimaryGroup,
    _Inout_ PULONG PrimaryGroupSize);

NTSYSAPI
NTSTATUS
NTAPI
RtlSelfRelativeToAbsoluteSD2(_Inout_ PSECURITY_DESCRIPTOR
                                 pSelfRelativeSecurityDescriptor,
                             _Inout_ PULONG pBufferSize);

NTSYSAPI
VOID NTAPI RtlSetAllBits(_In_ PRTL_BITMAP BitMapHeader);

NTSYSAPI
VOID NTAPI RtlSetBits(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG StartingIndex,
                      _In_ ULONG NumberToSet);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetDaclSecurityDescriptor(_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                             _In_ BOOLEAN DaclPresent, _In_opt_ PACL Dacl,
                             _In_ BOOLEAN DaclDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetGroupSecurityDescriptor(_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                              _In_opt_ PSID Group,
                              _In_opt_ BOOLEAN GroupDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetOwnerSecurityDescriptor(_Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                              _In_opt_ PSID Owner, _In_ BOOLEAN OwnerDefaulted);

NTSYSAPI
NTSTATUS
NTAPI
RtlSetSaclSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                             _In_ BOOLEAN SaclPresent, _In_opt_ PACL Sacl,
                             _In_opt_ BOOLEAN SaclDefaulted);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlSplay(_Inout_ PRTL_SPLAY_LINKS Links);

NTSYSAPI
NTSTATUS
NTAPI
RtlStringFromGUID(_In_ REFGUID Guid, _Out_ PUNICODE_STRING GuidString);

NTSYSAPI
PUCHAR
NTAPI
RtlSubAuthorityCountSid(_In_ PSID Sid);

NTSYSAPI
PULONG
NTAPI
RtlSubAuthoritySid(_In_ PSID Sid, _In_ ULONG SubAuthority);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlSubtreePredecessor(_In_ PRTL_SPLAY_LINKS Links);

NTSYSAPI
PRTL_SPLAY_LINKS
NTAPI
RtlSubtreeSuccessor(_In_ PRTL_SPLAY_LINKS Links);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
BOOLEAN
NTAPI
RtlTestBit(_In_ PRTL_BITMAP BitMapHeader, _In_ ULONG BitNumber);
#endif

NTSYSAPI
VOID NTAPI RtlUnlockBootStatusData(_In_ HANDLE BootStatusDataHandle);

NTSYSAPI
NTSTATUS
NTAPI
RtlCreateSecurityDescriptor(_Out_ PSECURITY_DESCRIPTOR SecurityDescriptor,
                            _In_ ULONG Revision);

NTSYSAPI
BOOLEAN
NTAPI
RtlValidRelativeSecurityDescriptor(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptorInput,
    _In_ ULONG SecurityDescriptorLength,
    _In_ SECURITY_INFORMATION RequiredInformation);

NTSYSAPI
BOOLEAN
NTAPI
RtlValidSecurityDescriptor(_In_ PSECURITY_DESCRIPTOR SecurityDescriptor);

NTSYSAPI
BOOLEAN
NTAPI
RtlValidSid(_In_ PSID Sid);

NTSYSAPI
NTSTATUS
NTAPI
RtlVerifyVersionInfo(_In_ RTL_OSVERSIONINFOEXW VersionInfo, _In_ ULONG TypeMask,
                     _In_ ULONGLONG ConditionMask);

NTSYSAPI
ULONGLONG
NTAPI
VerSetConditionMask(_In_ ULONGLONG ConditionMask, _In_ ULONG TypeMask,
                    _In_ UCHAR Condition);

#if NTDDI_VERSION >= NTDDI_VISTA
NTSYSAPI
NTSTATUS
NTAPI
TpAllocPool(_Out_ PTP_POOL* PoolReturn, _Reserved_ PVOID Reserved);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
NTSTATUS
NTAPI
TpDisablePoolCallbackChecks(_Inout_ PTP_POOL Pool);
#endif

NTSYSAPI
VOID NTAPI TpReleasePool(_Inout_ PTP_POOL Pool);

NTSYSAPI
VOID NTAPI TpSetPoolMaxThreads(_Inout_ PTP_POOL Pool, _In_ LONG MaxThreads);

NTSYSAPI
NTSTATUS
NTAPI
TpSetPoolMinThreads(_Inout_ PTP_POOL Pool, _In_ LONG MinThreads);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
NTSTATUS
NTAPI
TpQueryPoolStackInformation(
    _In_ PTP_POOL Pool, _Out_ PTP_POOL_STACK_INFORMATION PoolStackInformation);

NTSYSAPI
NTSTATUS
NTAPI
TpSetPoolStackInformation(_Inout_ PTP_POOL Pool,
                          _In_ PTP_POOL_STACK_INFORMATION PoolStackInformation);
#endif

NTSYSAPI
NTSTATUS
NTAPI
TpAllocCleanupGroup(_Out_ PTP_CLEANUP_GROUP* CleanupGroupReturn);

NTSYSAPI
VOID NTAPI TpReleaseCleanupGroup(_Inout_ PTP_CLEANUP_GROUP CleanupGroup);

NTSYSAPI
VOID NTAPI TpReleaseCleanupGroupMembers(_Inout_ PTP_CLEANUP_GROUP CleanupGroup,
                                        _In_ LOGICAL CancelPendingCallbacks,
                                        _Inout_opt_ PVOID CleanupParameter);

NTSYSAPI
NTSTATUS
NTAPI
TpSimpleTryPost(_In_ PTP_SIMPLE_CALLBACK Callback, _Inout_opt_ PVOID Context,
                _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

NTSYSAPI
NTSTATUS
NTAPI
TpAllocWork(_Out_ PTP_WORK* WorkReturn, _In_ PTP_WORK_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

NTSYSAPI
VOID NTAPI TpReleaseWork(_Inout_ PTP_WORK Work);

NTSYSAPI
VOID NTAPI TpPostWork(_Inout_ PTP_WORK Work);

NTSYSAPI
VOID NTAPI TpWaitForWork(_Inout_ PTP_WORK Work,
                         _In_ LOGICAL CancelPendingCallbacks);

NTSYSAPI
NTSTATUS
NTAPI
TpAllocTimer(_Out_ PTP_TIMER* Timer, _In_ PTP_TIMER_CALLBACK Callback,
             _Inout_opt_ PVOID Context,
             _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

NTSYSAPI
VOID NTAPI TpReleaseTimer(_Inout_ PTP_TIMER Timer);

NTSYSAPI
VOID NTAPI TpSetTimer(_Inout_ PTP_TIMER Timer, _In_opt_ PLARGE_INTEGER DueTime,
                      _In_ LONG Period, _In_opt_ LONG WindowLength);

NTSYSAPI
LOGICAL
NTAPI
TpIsTimerSet(_In_ PTP_TIMER Timer);

NTSYSAPI
VOID NTAPI TpWaitForTimer(_Inout_ PTP_TIMER Timer,
                          _In_ LOGICAL CancelPendingCallbacks);

NTSYSAPI
NTSTATUS
NTAPI
TpAllocWait(_Out_ PTP_WAIT* WaitReturn, _In_ PTP_WAIT_CALLBACK Callback,
            _Inout_opt_ PVOID Context,
            _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

NTSYSAPI
VOID NTAPI TpReleaseWait(_Inout_ PTP_WAIT Wait);

NTSYSAPI
VOID NTAPI TpSetWait(_Inout_ PTP_WAIT Wait, _In_opt_ HANDLE Handle,
                     _In_opt_ PLARGE_INTEGER Timeout);

NTSYSAPI
NTSTATUS
NTAPI
TpAllocIoCompletion(_Out_ PTP_IO* IoReturn, _In_ HANDLE File,
                    _In_ PTP_IO_CALLBACK Callback, _Inout_opt_ PVOID Context,
                    _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

NTSYSAPI
VOID NTAPI TpWaitForIoCompletion(_Inout_ PTP_IO Io,
                                 _In_ LOGICAL CancelPendingCallbacks);

NTSYSAPI
NTSTATUS
NTAPI
TpAllocAlpcCompletion(_Out_ PTP_ALPC* AlpcReturn, _In_ HANDLE AlpcPort,
                      _In_ PTP_ALPC_CALLBACK Callback,
                      _Inout_opt_ PVOID Context,
                      _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
NTSTATUS
NTAPI
TpAllocAlpcCompletionEx(_Out_ PTP_ALPC* AlpcReturn, _In_ HANDLE AlpcPort,
                        _In_ PTP_ALPC_CALLBACK_EX Callback,
                        _Inout_opt_ PVOID Context,
                        _In_opt_ PTP_CALLBACK_ENVIRON CallbackEnviron);
#endif

NTSYSAPI
VOID NTAPI TpReleaseAlpcCompletion(_Inout_ PTP_ALPC Alpc);

NTSYSAPI
VOID NTAPI TpWaitForAlpcCompletion(_Inout_ PTP_ALPC Alpc);
#endif

#if NTDDI_VERSION >= NTDDI_WIN7
NTSYSAPI
NTSTATUS
NTAPI
TpAlpcRegisterCompletionList(_Inout_ PTP_ALPC Alpc);

NTSYSAPI
NTSTATUS
NTAPI
TpAlpcUnregisterCompletionList(_Inout_ PTP_ALPC Alpc);
#endif

#ifdef __cplusplus
};
#endif

#endif  // _NTDLL_H
